IT SBIT Services
Schneeberger
DEEN
CVE tracker

Expivi 3D Product Configurator for WooCommerce: Unauthenticated remote code execution

CVE-2026-103889Critical 9.8Public exploit

← All vulnerabilities

Summary

The Expivi 3D Product Configurator for WooCommerce WordPress plugin, versions up to and including 2.16.2, contains a flaw in the 'xpv_image' POST parameter. Missing authentication and nonce checks allow an unauthenticated attacker to send a single crafted POST request to any URL on the site, and the input is rendered unsanitised into a PDF template with PHP execution enabled. A successful attack allows arbitrary code execution on the web server. A public proof-of-concept exists, and the CVSS score is 9.8 (critical).

Affected

  • Expivi 3D Product Configurator for WooCommerce (WordPress plugin), all versions up to and including 2.16.2

Fixed in

  • Version 2.16.3 according to a third-party proof-of-concept README; not yet confirmed by the vendor, Wordfence or the WordPress.org changelog. Verify before rollout.
  • Any version newer than 2.16.2 is the only documented remedy.

Workaround

  • No vendor workaround known.
  • If patching is delayed, deactivate and remove the plugin. Unverified whether a deactivated plugin still exposes the handler, so treat installed copies as at risk until removed.

Exploitation

  • Public proof-of-concept: yes (GitHub repository).
  • CISA KEV: not listed as of the checked third-party aggregator; verify on the CISA catalogue.
  • In-the-wild exploitation: unknown.
  • CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

  • Identify all WordPress/WooCommerce sites running this plugin, starting with internet-facing sites.
  • Update to a version newer than 2.16.2 after confirming the fixed version against the official changelog, or remove the plugin.
  • If a vulnerable version was exposed, check for compromise: unexpected PHP files in upload and plugin directories, suspicious POST requests in web server logs, and rotate credentials if compromise is suspected.
  • Monitor for active exploitation.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:02.

Original description (NVD)

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.

NVD references (8)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed