Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-103889 EUVD-2026-96055GHSA-m7vx-2p8f-r357

3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

Published Oct 10, 2026 · Updated Oct 11, 2026 · Assigned by Wordfence

Vendor: expivi Product: 3D Product configurator for WooCommerce Category: Web / CMS

Description

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.

Affected products

VendorProductAffectedFixed
expivi 3D Product configurator for WooCommerce ≤ 2.16.2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • kayes817/CVE-2026-103889 ★ 1 · Oct 12, 2026

    Proof of concept and isolated Docker lab for CVE-2026-103889, an unauthenticated RCE vulnerability in Expivi 3D Product Configurator for WooCommerce ≤ 2.16.2.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References