Unauthenticated file upload in payever WooCommerce Gateway
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The payever WooCommerce Gateway plugin for WordPress is affected up to and including 4.8.0. Its WooCommerce API callbacks have no authentication or capability check, and its image upload routine saves a remotely fetched file to the public uploads directory before checking the file type (CWE-434). An unauthenticated remote attacker can therefore write an executable PHP file and run code on the server.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for payever Checkout (Composable Payment Gateway).
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-07 Threatist record created from CVE-2026-93754
- 2026-11-07 Alias added: GHSA-5w75-33gq-gccg
- 2026-11-08 CISA SSVC decision points changed
References
Other 13
- https://www.wordfence.com/threat-intel/vulnerabilities/id/03412063-d73a-4c5c-8dc6-3e76a5d975a5?source=cve
- https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-synchronization.php?rev=3647773#L22
- https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-synchronization.php?rev=3647773#L116
- https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/woocommerce-payever-gateway.php?rev=3647773#L145
- https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/logger/class-payever-logger.php?rev=3647773#L18
- https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-log-manager.php?rev=3647773#L35
- https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/management/class-payever-subscription-manager.php?rev=3647773#L79
- https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-synchronization.php?rev=3647773#L683
- https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/management/class-payever-import-manager.php?rev=3647773#L21
- https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/actions/class-payever-action-update-product.php?rev=3647773#L448
- https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/actions/class-payever-action-update-product.php?rev=3647773#L547
- https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/vendor/payever/core-sdk-php/lib/Payever/Core/Http/Client/CurlClient.php?rev=3647773#L258
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3761918%40payever-woocommerce-gateway&new=3761918%40payever-woocommerce-gateway
More payever vulnerabilities
- TI-2026-70355 PHP Object Injection in Payever WooCommerce Gateway plugin CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-93754 · CVE Program
- CVE-2026-93754 · NVD
- FIRST EPSS
- GHSA-5w75-33gq-gccg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences