{"id":"CVE-2026-93754","kind":"vulnerability","aliases":["CVE-2026-93754"],"related":[],"title":"WordPress payever WooCommerce plugin: unauthenticated file upload leads to code execution","description":"The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.","summary":"The payever WooCommerce Gateway plugin for WordPress, up to and including 4.8.0, has API callbacks with no authentication, and its image upload routine writes remotely fetched files to the public uploads folder before checking the file type. An unauthenticated attacker can upload a PHP file and run commands on the site server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","payever","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-above-4.8.0"],"how_to_check":"- Check whether the payever WooCommerce Gateway plugin is installed and its version is `4.8.0` or lower\n- Look for unexpected PHP files under the WordPress uploads directory, such as `wp-content/uploads/`","fix":"- Move the payever WooCommerce Gateway plugin to a version newer than `4.8.0`; the fixed version is unknown from the sources","status":"open","published_at":"2026-11-07T03:17:08+00:00","first_seen_at":"2026-11-07T03:45:35+00:00","triaged_at":"2026-11-07T03:47:45+00:00","updated_at":"2026-11-07T03:47:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T03:47:45Z","model":"claude-haiku-5-5","output":{"fix":"- Move the payever WooCommerce Gateway plugin to a version newer than `4.8.0`; the fixed version is unknown from the sources","reach":"internet","title":"WordPress payever WooCommerce plugin: unauthenticated file upload leads to code execution","impact":"high","summary":"The payever WooCommerce Gateway plugin for WordPress, up to and including 4.8.0, has API callbacks with no authentication, and its image upload routine writes remotely fetched files to the public uploads folder before checking the file type. An unauthenticated attacker can upload a PHP file and run commands on the site server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","payever","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker runs PHP code on the web server","analyst_note":"Find the fixed plugin version and any vendor advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-93754.","how_to_check":"- Check whether the payever WooCommerce Gateway plugin is installed and its version is `4.8.0` or lower\n- Look for unexpected PHP files under the WordPress uploads directory, such as `wp-content/uploads/`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-4.8.0"],"who_is_affected":"Sites running the payever WooCommerce Gateway WordPress plugin version 4.8.0 or earlier are exposed, because its API callbacks accept requests without any login or permission check. The flaw is reachable over the internet, so any WooCommerce store with this plugin should be reviewed. Sites without the plugin are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000773,"input_tokens":4434,"output_tokens":660,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-862':203C '-93754':14A,17A '/cwe-798':204C '4.8.0':36B,102C 'achiev':168C 'api':38B,106C,111C 'arbitrari':87C 'attack':64B,146C,160C 'attacker-control':145C 'authent':42B,123C 'basenam':148C 'call':189C 'callback':39B,107C 'capabl':124C 'chain':181C 'check':58B,125C 'code':10A,93C,170C,198C 'command':72B 'control':147C 'credenti':199C 'cve':12A,15A 'cwe':202C 'depend':182C 'directori':142C 'execut':11A,94C,164C,171C 'exploit':207C 'fetch':50B,136C 'file':6A,51B,60B,69B,88C,137C,152C,166C 'folder':56B 'full':180C 'gateway':28B,80C 'hard':197C 'hard-coded-credenti':196C 'host':22B 'ident':200C 'imag':45B,131C 'includ':35B,101C 'incom':118C 'independ':206C 'key':112C 'lead':8A,90C 'leg':177C 'make':155C 'nonc':127C 'note':172C 'outbound':187C 'overwrit':201C 'packag':18B 'payev':2A,19B,26B,78C,108C,113C,116C,191C 'php':68B,165C 'plugin':4A,29B,81C,185C 'possibl':157C 'public':54B,140C 'recoveri':176C 'regist':120C 'remot':49B,92C,135C,169C 'routin':47B,132C 'run':71B 'sandbox':110C 'self':21B 'self-host':20B 'server':76B 'servic':193C 'set':109C 'site':75B 'subscript':115C 'synchron':117C 'three':103C 'toggl':114C 'token':175C 'token-recoveri':174C 'type':61B,153C 'unauthent':5A,63B,159C,195C 'upload':7A,46B,55B,66B,89C,130C,141C 'use':143C 'valid':150C 'validatetoken':188C 'various':96C 'version':97C 'vulner':85C 'woocommerc':3A,23B,27B,79C,105C 'woocommerce-api':104C 'wordpress':1A,24B,31B,83C 'write':48B,133C,162C","nicknames":[],"mitigations":[],"who_affected":"Sites running the payever WooCommerce Gateway WordPress plugin version 4.8.0 or earlier are exposed, because its API callbacks accept requests without any login or permission check. The flaw is reachable over the internet, so any WooCommerce store with this plugin should be reviewed. Sites without the plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","package","payever","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-2026':13A,16A '-93754':14A,17A 'code':10A 'cve':12A,15A 'execut':11A 'file':6A 'lead':8A 'payev':2A 'plugin':4A 'unauthent':5A 'upload':7A 'woocommerc':3A 'wordpress':1A","search_b":"'4.8.0':36B 'api':38B 'attack':64B 'authent':42B 'callback':39B 'check':58B 'command':72B 'fetch':50B 'file':51B,60B,69B 'folder':56B 'gateway':28B 'host':22B 'imag':45B 'includ':35B 'packag':18B 'payev':19B,26B 'php':68B 'plugin':29B 'public':54B 'remot':49B 'routin':47B 'run':71B 'self':21B 'self-host':20B 'server':76B 'site':75B 'type':61B 'unauthent':63B 'upload':46B,55B,66B 'woocommerc':23B,27B 'wordpress':24B,31B 'write':48B","search_c":"'-862':203C '/cwe-798':204C '4.8.0':102C 'achiev':168C 'api':106C,111C 'arbitrari':87C 'attack':146C,160C 'attacker-control':145C 'authent':123C 'basenam':148C 'call':189C 'callback':107C 'capabl':124C 'chain':181C 'check':125C 'code':93C,170C,198C 'control':147C 'credenti':199C 'cwe':202C 'depend':182C 'directori':142C 'execut':94C,164C,171C 'exploit':207C 'fetch':136C 'file':88C,137C,152C,166C 'full':180C 'gateway':80C 'hard':197C 'hard-coded-credenti':196C 'ident':200C 'imag':131C 'includ':101C 'incom':118C 'independ':206C 'key':112C 'lead':90C 'leg':177C 'make':155C 'nonc':127C 'note':172C 'outbound':187C 'overwrit':201C 'payev':78C,108C,113C,116C,191C 'php':165C 'plugin':81C,185C 'possibl':157C 'public':140C 'recoveri':176C 'regist':120C 'remot':92C,135C,169C 'routin':132C 'sandbox':110C 'servic':193C 'set':109C 'subscript':115C 'synchron':117C 'three':103C 'toggl':114C 'token':175C 'token-recoveri':174C 'type':153C 'unauthent':159C,195C 'upload':89C,130C,141C 'use':143C 'valid':150C 'validatetoken':188C 'various':96C 'version':97C 'vulner':85C 'woocommerc':79C,105C 'woocommerce-api':104C 'wordpress':83C 'write':133C,162C","first_public_at":"2026-11-07T03:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93754","severity":null,"published_at":"2026-11-07T03:17:08+00:00","modified_at":"2026-11-07T03:17:08+00:00","first_seen_at":"2026-11-07T03:45:35+00:00","fetched_at":"2026-11-07T03:45:35+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}