Remote code execution in 3D Product configurator for WooCommerce
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The expivi 3D Product configurator for WooCommerce plugin for WordPress is affected in all versions up to and including 2.16.2. Missing authentication and nonce checks in the wp_loaded handler let the xpv_image parameter reach a Dompdf-rendered HTML template without sanitization, with PHP execution enabled (CWE-434). An unauthenticated remote attacker can execute code on the server by sending one unauthenticated request to any URL on the site.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for 3D Product configurator for WooCommerce.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-10 Threatist record created from CVE-2026-103889
- 2026-10-10 Alias added: GHSA-m7vx-2p8f-r357
- 2026-10-11 CISA SSVC decision points changed
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/46f69f7b-6d9b-494d-b123-63fc5ebcb6f3?source=cve
- https://plugins.trac.wordpress.org/browser/expivi/tags/2.16.2/templates/pdf/pdf-configuration-details.phtml#L199
- https://plugins.trac.wordpress.org/browser/expivi/tags/2.16.2/classes/woocommerce/class-expivi-cart-manager.php#L238
- https://plugins.trac.wordpress.org/browser/expivi/tags/2.16.2/classes/woocommerce/class-expivi-cart-manager.php#L212
- https://plugins.trac.wordpress.org/browser/expivi/tags/2.16.2/classes/woocommerce/class-expivi-cart-manager.php#L95
- https://plugins.trac.wordpress.org/browser/expivi/tags/2.16.2/classes/pdf/class-pdf.php#L34
- https://plugins.trac.wordpress.org/browser/expivi/tags/2.16.2/classes/woocommerce/class-expivi-cart-manager.php#L598
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3723323%40expivi&new=3723323%40expivi
Sources
- CVE-2026-103889 · CVE Program
- CVE-2026-103889 · NVD
- FIRST EPSS
- GHSA-m7vx-2p8f-r357 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences