CVE-2026-103889

CVE-2026-103889 is a remote code execution vulnerability affecting the "3D Product configurator for WooCommerce" WordPress plugin (developed by Expivi) in all versions up to and including 2.16.2. The issue stems from the plugin's `wp_loaded` handler, where the intended nonce and authentication checks are entirely enclosed within a block comment. Because these security checks are commented out and not executed, the endpoint is left fully accessible to unauthenticated users via a single POST request to any URL on the affected site. An attacker can exploit this flaw by sending a crafted POST request containing the `xpv_image` parameter. Because this parameter is not sanitized, its value is echoed unescaped into a Dompdf-rendered HTML template that has PHP execution enabled. This allows unauthenticated attackers to execute arbitrary PHP code on the hosting server. Recommended mitigations include updating the plugin to a patched version (such as version 2.16.3 or newer) or deactivating the plugin if a patch cannot be applied.