Key points
- The National Vulnerability Database rates CVE-2026-103889 as critical with a CVSS score of 9.8.
- Exploitation requires no authentication, allowing attackers to execute code via a single POST request.
- The vulnerability affects all versions of the 3D Product Configurator for WooCommerce up to and including 2.16.2.
The short version
- A critical remote code execution vulnerability exists in the 3D Product Configurator for WooCommerce plugin.
- Attackers can exploit this flaw without logging in, gaining the ability to run arbitrary code on the server.
- The issue stems from commented-out security checks and lack of input sanitization in the plugin’s code.
The details
The National Vulnerability Database lists CVE-2026-103889 as a critical severity issue with a CVSS score of 9.8. This rating reflects the ease of exploitation and the severe impact on server integrity. The flaw resides within the 3D Product Configurator for WooCommerce plugin, a tool used by online stores to display interactive product models. According to the NVD record, the vulnerability affects all plugin versions up to and including 2.16.2.
The technical root cause involves a failure in the plugin’s `wp_loaded` handler. This handler is responsible for processing specific requests, but it lacks necessary authentication and nonce checks. A nonce, or number used once, is a security token that prevents cross-site request forgery attacks. The source material indicates that the only existing authentication check in the handler is entirely enclosed within a block comment. This commented-out code means the security measure is inactive, leaving the endpoint open to unauthorised access.
Attackers can exploit this weakness by sending a single unauthenticated POST request to any URL on the affected site. The request targets the `xpv_image` parameter. The plugin fails to sanitise this input before echoing it unescaped into a Dompdf-rendered HTML template. Because PHP execution is enabled within this template, the unfiltered input allows for remote code execution. This aligns with CWE-434, a weakness classification for unrestricted upload of executable code, as noted in the NVD description.
The context
Remote code execution vulnerabilities are among the most dangerous threats to web applications. They allow attackers to take full control of the server hosting the application. In this case, the lack of authentication means that any individual on the internet can attempt exploitation without needing valid user credentials. This significantly increases the attack surface for WordPress sites that use the 3D Product Configurator for WooCommerce.
The specific combination of missing nonce checks and unsanitised input creates a direct path to server compromise. The use of Dompdf, a library for converting HTML to PDF, becomes a vector for attack when PHP execution is permitted within the rendered templates. This architectural decision, combined with the commented-out security logic, results in a critical failure of the plugin’s defence mechanisms. Website administrators must be aware that this flaw does not require complex exploits; a simple POST request is sufficient to trigger the vulnerability.
Defender's checklist
- Identify if the 3D Product Configurator for WooCommerce plugin is installed on any managed WordPress sites.
- Check the current version of the plugin to determine if it is 2.16.2 or older.
- Review server logs for unusual POST requests to URLs associated with the plugin’s functionality.
- Monitor for signs of unauthorized code execution or new files appearing in the server directory.
Background: Remote code execution vulnerabilities
Remote code execution vulnerabilities let attackers run arbitrary commands on a target system remotely. They exploit flaws in how software processes untrusted input. Prevention requires strict input validation, least privilege access, and regular patching. These flaws remain dangerous because they grant immediate control over the affected machine.
Read the full guide: Remote Code Execution Vulnerabilities: How They Work and How to Stop Them
What to do and how to stay safe: CVE-2026-103889
- Audit all WordPress installations to identify sites using the 3D Product Configurator for WooCommerce plugin.
- Verify the installed version against the vulnerable range of up to 2.16.2 to assess exposure.
- Monitor server access logs for unauthenticated POST requests targeting the `xpv_image` parameter.
- Wait for the vendor to provide a confirmed update before applying changes to production environments.
Step-by-step guide: Unpatched Software: Why Missing Updates Create Hidden Entry Points
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the 3D Product Configurator are affected?
All versions up to and including 2.16.2 are vulnerable to this remote code execution flaw.
Is authentication required to exploit CVE-2026-103889?
No, the vulnerability allows unauthenticated attackers to execute code on the server.
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns a CVSS score of 9.8, rating it as critical.
