3D Product Configurator: Commented-Out Check Enables Unauthenticated RCE on WordPress via Single POST

The 3D Product Configurator for WooCommerce plugin contains a critical remote code execution vulnerability that allows unauthenticated attackers to take full control of vulnerable WordPress servers. The National Vulnerability Database assigned CVE-2026-103889 a CVSS score of 9.8, categorizing the severity as Critical. The flaw stems from a fundamental failure in input validation and access control within the plugin’s core processing logic.

Root cause

The vulnerability arises because the plugin’s `wp_loaded` handler lacks proper authentication and nonce verification. According to the NVD record, the only existing nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement code. This oversight leaves the endpoint open to any user, regardless of their login status or permissions.

Additionally, the plugin fails to sanitize the `xpv_image` POST parameter before processing it. The unsanitized input is echoed directly into a Dompdf-rendered HTML template. Because PHP execution is enabled within this template, any malicious code injected via the parameter is interpreted and executed by the server.

Attack path

An attacker can exploit this issue using a single unauthenticated POST request to any URL on the affected site. The request must include the `xpv_image` parameter containing the malicious payload. Since the handler does not verify user identity or request validity, the server processes the input immediately.

The injected code is rendered by Dompdf, which executes the PHP commands embedded in the HTML template. This allows the attacker to run arbitrary system commands on the server. The NVD description identifies the underlying weakness as CWE-434, which relates to uncontrolled search path elements or improper input handling leading to code execution.

Affected versions

All versions of the 3D Product Configurator for WooCommerce plugin up to and including version 2.16.2 are affected by this vulnerability. The plugin is developed by Expivi. Sites running any version prior to 2.16.3 remain exposed to this critical remote code execution risk. No newer version is confirmed in the provided source material as containing a fix.

Mitigation

• Monitor server logs for unusual POST requests containing the `xpv_image` parameter.
• Implement web application firewalls to block unauthenticated access to known vulnerable endpoints.
• Restrict server-side PHP execution capabilities in directories used by third-party plugins.
• Verify the plugin version and check for updates from the vendor regularly.

What to do and how to stay safe: WooCommerce

• Review your WordPress plugin list to identify if the 3D Product Configurator for WooCommerce is installed.
• Check the current version number against the affected range of up to 2.16.2.
• Once the vendor provides an update, apply it immediately to patch the authentication bypass.
• Monitor server access logs for suspicious POST requests that do not originate from authenticated users.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-103889?

The National Vulnerability Database rates CVE-2026-103889 as Critical with a CVSS score of 9.8.

Which versions of the plugin are vulnerable?

All versions of the 3D Product Configurator for WooCommerce plugin up to and including 2.16.2 are vulnerable.

Does the vulnerability require a user to log in?

No, the vulnerability allows unauthenticated attackers to execute code via a single POST request.