---
id: "CVE-2026-93754"
page: "https://infrastack.ai/live/CVE-2026-93754"
kind: "vulnerability"
aliases: ["CVE-2026-93754"]
title: "WordPress payever WooCommerce plugin: unauthenticated file upload leads to code execution"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "payever", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-above-4.8.0"]
published_at: "2026-11-07T03:17:08+00:00"
first_seen_at: "2026-11-07T03:45:35+00:00"
updated_at: "2026-11-07T03:47:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93754", "first_seen_at": "2026-11-07T03:45:35+00:00"}]
exploit_sources: []
---

# WordPress payever WooCommerce plugin: unauthenticated file upload leads to code execution

Link for people: https://infrastack.ai/live/CVE-2026-93754 (this .md is for agents)

The payever WooCommerce Gateway plugin for WordPress, up to and including 4.8.0, has API callbacks with no authentication, and its image upload routine writes remotely fetched files to the public uploads folder before checking the file type. An unauthenticated attacker can upload a PHP file and run commands on the site server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the payever WooCommerce Gateway plugin is installed and its version is `4.8.0` or lower
- Look for unexpected PHP files under the WordPress uploads directory, such as `wp-content/uploads/`

## Fix

- Move the payever WooCommerce Gateway plugin to a version newer than `4.8.0`; the fixed version is unknown from the sources

## Timeline

- 2026-11-07T03:45:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93754

## From the sources

The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_