CVE-2026-103889 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
Unauthenticated attackers can execute arbitrary code on the server via the xpv_image parameter in the 3D Product configurator for WooCommerce plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103889?
CVE-2026-103889 is a critical code injection vulnerability in expivi 3D Product configurator for WooCommerce, published on 10 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.
Weakness: CWE-434
Which versions are affected by CVE-2026-103889?
How do I fix CVE-2026-103889?
No fix has been published for CVE-2026-103889 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-103889 being exploited?
There is no known exploitation of CVE-2026-103889 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-m7vx-2p8f-r357.