Key points
- The vulnerability affects all versions of the plugin up to and including 2.16.2.
- The National Vulnerability Database rates CVE-2026-103889 as critical with a CVSS score of 9.8.
- Attackers can exploit the issue by sending a single unauthenticated POST request to any URL on the site.
Site administrators using the 3D Product Configurator for WooCommerce must update their plugins immediately to block a severe remote code execution flaw. The National Vulnerability Database lists CVE-2026-103889 as a critical vulnerability affecting all versions of the plugin up to 2.16.2. This flaw allows attackers to run arbitrary code on the server without any form of authentication.
The exploit works because the plugin’s handler lacks proper security checks. According to the NVD record, the code fails to sanitize the 'xpv_image' POST parameter before echoing it into a Dompdf-rendered template. This template has PHP execution enabled, turning the input into a direct path for remote code execution by unauthenticated attackers.
What we know
The root cause involves a commented-out security check within the plugin’s code. The NVD description notes that the only nonce and authentication check in the wp_loaded handler is entirely enclosed in a block comment. This omission leaves the endpoint reachable via a single unauthenticated POST to any URL on the WordPress site hosting the plugin.
This issue is classified under CWE-434, which relates to uncontrolled search path elements, though the immediate risk is the ability to execute code remotely. The vulnerability exists in versions up to and including 2.16.2 of the 3D Product Configurator for WooCommerce, developed by expivi. No newer patched version is mentioned in the current records.
Defender's checklist
- Identify all WordPress sites running the 3D Product Configurator for WooCommerce plugin.
- Check the installed version number against the affected range of up to 2.16.2.
- Review server logs for unusual POST requests to unexpected URLs on the site.
- Verify that no unauthorized code has been executed or files modified on the server.
What to do and how to stay safe: WooCommerce
- Audit your WordPress plugin list and remove any unused versions of the 3D Product Configurator.
- Monitor server access logs for suspicious POST requests targeting the 'xpv_image' parameter.
- Implement a web application firewall to block unauthenticated POST requests to known vulnerable endpoints.
- Wait for the vendor to release a confirmed fix before restoring the plugin if you need its functionality.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the plugin are vulnerable to this remote code execution flaw?
All versions of the 3D Product Configurator for WooCommerce up to and including 2.16.2 are vulnerable.
What is the CVSS score for CVE-2026-103889?
The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.8.
Does an attacker need to log in to exploit this vulnerability?
No, the vulnerability allows unauthenticated attackers to execute code via a single POST request.
