CVE-2026-93754 · Package
NO FIX YET · SEE WHAT TO DO
The payever WooCommerce Gateway plugin for WordPress, up to and including 4.8.0, has API callbacks with no authentication, and its image upload routine writes remotely fetched files to the public uploads folder before checking the file type. An unauthenticated attacker can upload a PHP file and run commands on the site server.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the payever WooCommerce Gateway WordPress plugin version 4.8.0 or earlier are exposed, because its API callbacks accept requests without any login or permission check. The flaw is reachable over the internet, so any WooCommerce store with this plugin should be reviewed. Sites without the plugin are not affected.
Not affected if plugin-not-installed, version-above-4.8.0
Who cares payever, self-hosted, woocommerce, wordpress
4.8.0 or lowerwp-content/uploads/4.8.0; the fixed version is unknown from the sourcesThe payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.