Skip to content
OpenAdvisories
Critical · 9.8 Scanner template Public exploit CVE-2026-3891 EUVD-2026-11760

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

Published Mar 13, 2026 · Updated Apr 8, 2026 · Assigned by Wordfence

Vendor: linknacional Product: Pix for WooCommerce Category: Web / CMS

Description

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected products

VendorProductAffectedFixed
linknacional Pix for WooCommerce ≤ 1.5.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

GitHub 9 repositories

  • m4sh-wacker/CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit ★ 21 · Jul 15, 2026

    PoC for CVE-2026-3891 — Unauthenticated Arbitrary File Upload leading to Remote Code Execution in Pix for WooCommerce <= 1.5.0

  • joshuavanderpoll/CVE-2026-3891 ★ 8 · Mar 13, 2026

    Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload (CVE-2026-3891) PoC

  • Nxploited/CVE-2026-3891 ★ 6 · Mar 27, 2026

    Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

  • shinthink/CVE-2026-3891 ★ 4 · Jul 15, 2026

    Pix for WooCommerce Unauthenticated File Upload via certificate_crt_path Parameter | CVSS 9.8

  • Ch4120N/CVE-2026-3891 ★ 2 · Aug 3, 2026

    PoC for CVE-2026-3891 – Unauthenticated File Upload RCE in Pix for WooCommerce ≤ 1.5.0. Automated nonce retrieval, PHP upload, and command execution.

  • willygailo/CVE-2026-3891-Linux ★ 2 · May 31, 2026

    ⚡ This tool exploits CVE-2026-3891, a critical unauthenticated arbitrary file upload vulnerability found in the Pix for WooCommerce WordPress plugin (versions ≤ 1.5.0).

  • AnggaTechI/Mass-Scanner-CVE-2026-3891 ★ 2 · Apr 16, 2026

    CVE-2026-3891 Mass Scanning

  • katranSefa/CVE-2026-3891 ★ 0 · Sep 5, 2026
  • VeronnX666/CVE-2026-3891 ★ 0 · Jul 19, 2026

    This tool was created solely for educational purposes, not for criminal activities or anything of the sort. Do not misuse this tool. Good luck trying it out.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References