CVE-2026-103889: WooCommerce 3D Configurator RCE Vulnerability

CVE-2026-103889 Overview

CVE-2026-103889 is an unauthenticated remote code execution vulnerability in the 3D Product configurator for WooCommerce plugin for WordPress. All versions up to and including 2.16.2 are affected. The flaw stems from a wp_loaded handler whose authentication and nonce checks were commented out, leaving the endpoint reachable via a single unauthenticated POST request to any URL on the site. The xpv_image POST parameter is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled, allowing attackers to execute arbitrary PHP code on the server. The vulnerability is tracked under [CWE-434] (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Unauthenticated attackers can achieve full remote code execution on any WordPress site running the affected plugin by sending a single crafted POST request.

Affected Products

3D Product configurator for WooCommerce (Expivi) plugin for WordPress
All plugin versions up to and including 2.16.2
WordPress sites with WooCommerce and the Expivi plugin active

Discovery Timeline

2026-10-10 - CVE-2026-103889 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-103889

Vulnerability Analysis

The plugin registers a handler on the WordPress wp_loaded action hook. This hook fires on every request to the WordPress site, meaning the handler executes regardless of the requested URL. The original handler contained nonce verification and capability checks, but these controls were wrapped in a block comment with no replacement logic. As a result, the endpoint accepts requests from unauthenticated clients.

When the handler processes a POST request, it takes the xpv_image parameter and passes it directly into a PDF generation routine. The parameter value is echoed into templates/pdf/pdf-configuration-details.phtml without sanitization or output escaping. The template is then rendered by Dompdf with the isPhpEnabled option set to true, which causes Dompdf to evaluate <?php ... ?> tags embedded in the HTML input.

The combination of missing authentication, unsanitized user input, and PHP-enabled Dompdf rendering produces a direct path from an unauthenticated HTTP request to arbitrary code execution in the web server's PHP process.

Root Cause

The root cause is twofold. First, the authentication and nonce logic in the wp_loaded handler is commented out, removing all access control from the endpoint. Second, Dompdf is instantiated with PHP evaluation enabled while receiving a template string that interpolates unescaped user input. See the WordPress Expivi PDF Class and the WordPress Expivi PDF Config Template for the affected code paths.

Attack Vector

An attacker sends a single HTTP POST request to any URL on the target WordPress site. The request body includes the xpv_image parameter with a payload containing embedded PHP tags. The wp_loaded hook fires, the unprotected handler accepts the request, and Dompdf evaluates the attacker-controlled PHP during PDF rendering. No authentication, user interaction, or prior access is required. Refer to the Wordfence Vulnerability Analysis and the Expivi Changeset Overview for additional technical context.

Detection Methods for CVE-2026-103889

Indicators of Compromise

POST requests to arbitrary URIs on the site containing an xpv_image parameter with PHP tag sequences such as <?php or <?=.
Unexpected PDF generation activity or new files written under WordPress upload directories by the web server process.
New or modified PHP files in wp-content/, wp-content/uploads/, or plugin directories without a corresponding administrator action.
Outbound connections initiated by the PHP-FPM or Apache worker process to attacker-controlled hosts following suspicious POST traffic.

Detection Strategies

Inspect web server access logs for POST requests containing the xpv_image parameter and flag payloads with encoded or raw PHP delimiters.
Monitor file integrity on WordPress installations to detect new PHP files or modifications to existing plugin and theme files.
Correlate PHP process spawns of shells (sh, bash, cmd.exe) or network utilities (curl, wget) with preceding HTTP POST events in the same session.

Monitoring Recommendations

Enable verbose web server logging that captures POST bodies or at minimum parameter names on WordPress hosts running WooCommerce.
Alert on invocations of PHP system functions such as exec, system, passthru, or shell_exec originating from Dompdf rendering contexts.
Track installed plugin versions across WordPress fleets and alert when the Expivi plugin is present at version 2.16.2 or earlier.

How to Mitigate CVE-2026-103889

Immediate Actions Required

Deactivate and remove the 3D Product configurator for WooCommerce plugin on all sites until a patched version is confirmed installed.
Update to a plugin release later than 2.16.2 once published by the vendor.
Audit WordPress file systems for unauthorized PHP files, modified plugin code, and new administrator accounts created since the plugin was installed.
Rotate WordPress secrets in wp-config.php, database credentials, and administrator passwords if compromise is suspected.

Patch Information

No patched version is listed in the NVD entry at publication. Monitor the Expivi Changeset Overview and the Wordfence Vulnerability Analysis for release details. Until a fix ships, uninstalling the plugin is the only reliable remediation.

Workarounds

Block POST requests containing the xpv_image parameter at a web application firewall (WAF) or reverse proxy.
Restrict access to the WordPress site to known IP addresses while the plugin remains installed.
Disable the plugin in the WordPress administrator console to prevent the wp_loaded hook from registering the vulnerable handler.

bash

# Example WAF rule concept (ModSecurity-style) to block PHP tags in the xpv_image parameter
SecRule ARGS:xpv_image "@rx (?i)<\?(php|=)" \
    "id:1026103889,phase:2,deny,status:403,log,msg:'CVE-2026-103889 Expivi RCE attempt'"