Remote Code Execution Vulnerability in 3D Product Configurator for WooCommerce by WordPress

CVE-2026-103889

What is CVE-2026-103889?

The 3D Product Configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution due to inadequate authentication and nonce checks. Specifically, the vulnerability arises from the handling of the 'xpv_image' parameter, which lacks proper sanitization before being rendered in an HTML template. This flaw allows unauthenticated attackers to potentially execute arbitrary PHP code on the server, posing a significant risk. The existing nonce and authentication checks are enclosed in comments and not functional, making the endpoint accessible with a single unauthenticated POST request from any URL on the site.

References