critical · CVSS v3 9.8

CVE-2026-93754

The payever WooCommerce Gateway plugin for WordPress allows unauthenticated file uploads that can lead to remote code execution. Vulnerable

Overview

The payever WooCommerce Gateway plugin for WordPress allows unauthenticated file uploads that can lead to remote code execution. Vulnerable in all versions up to 4.8.0 due to missing authentication and file type validation. Attackers can upload malicious PHP files to the public uploads directory.

Description

The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.

Impact

Confidentiality: attackers can read or modify site data via uploaded files. Integrity: arbitrary code can alter plugin behavior or site content. Availability: potential site takeover or denial of service. Defenders: site administrators, WordPress hosts, plugin maintainers.

Remediation

Update the payever WooCommerce Gateway plugin to the latest patched version (>=4.8.1) or apply the vendor's security patch. If update is not possible, disable the vulnerable API callbacks or restrict file uploads to the uploads directory by adding capability checks and file type validation. Ensure the WordPress uploads directory is not executable and monitor for unexpected PHP files.

Risk context

Severity is critical with CVSS 9.8, indicating high urgency. No EPSS data available, but the vulnerability allows unauthenticated remote code execution, making it a top priority for immediate patching.

Affected products

  • payever WooCommerce Gateway plugin
  • WordPress

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
—
EPSS
—

wordpress plugin arbitrary-file-upload remote-code-execution critical payever ecommerce

← All CVEs

Related CVEs

critical

CVE-2026-17362

IBM API Connect versions 12.1.0.0 to 12.1.1.2 contain a critical flaw that lets remote attackers create, modify, or delete tenants without proper authorization. This can compromise tenant isolation and data integrity. The vulnerability is exploitable via API calls without authentication.

View analysis

critical

CVE-2026-19803

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to arbitrary file upload that can lead to remote code execution for unauthenticated users when the Advanced Upload Popup is enabled. All versions up to 2.13.2 are affected, allowing attackers to write PHP files outside the uploads directory. This flaw enables attackers to compromise the entire site with no authentication required.

View analysis

critical

CVE-2026-16716

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment.

View analysis

critical

CVE-2026-16720

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed.

View analysis