How can attackers seize full server control of your WordPress site with just one unauthenticated POST request?

The 3D Product Configurator for WooCommerce plugin contains a severe security flaw that allows unauthenticated attackers to execute arbitrary code on WordPress servers. The National Vulnerability Database assigned CVE-2026-103889 a critical severity rating of 9.8. This vulnerability affects all plugin versions up to and including 2.16.2, exposing any site using these releases to immediate compromise without requiring user credentials.

How does the vulnerability work?

The flaw stems from missing authentication and nonce checks within the plugin’s wp_loaded handler. According to the NVD record, the developer failed to sanitize the 'xpv_image' POST parameter before echoing it into a Dompdf-rendered HTML template. This template has PHP execution enabled, allowing injected code to run on the server. The security checks that should have blocked this access are entirely enclosed in a block comment, leaving the endpoint open to abuse.

What is the attack surface?

Attackers can exploit this vulnerability by sending a single unauthenticated POST request to any URL on the affected site. The NVD description notes that the endpoint is reachable without any login or session validation. Because the authentication logic is commented out with no replacement, the server processes the malicious input directly. This low-barrier entry point makes automated scanning and exploitation trivial for threat actors targeting WooCommerce installations.

What are the operational risks?

Remote code execution grants attackers full control over the server hosting the WordPress site. Organizations face risks of data theft, site defacement, and the installation of malware or backdoors. Since the attack requires no authentication, public scanners can identify and exploit vulnerable sites rapidly. The critical CVSS score reflects the high impact and ease of exploitation, signaling that immediate attention is required to prevent widespread server compromise across affected e-commerce platforms.

What is the current status?

The NVD record identifies the affected plugin as expivi 3D Product Configurator for WooCommerce. The vulnerability is present in all versions up to 2.16.2. The source material does not confirm the release of a patched version or a specific fix date. Without an official update from the vendor, sites running these versions remain exposed to active exploitation. Administrators must monitor vendor communications closely for any security advisories or version updates that address this critical flaw.

What to do and how to stay safe: WooCommerce

• Audit your WordPress plugins to identify if you are running 3D Product Configurator for WooCommerce versions 2.16.2 or older.
• Restrict access to server resources by implementing strict firewall rules that limit POST requests to necessary endpoints.
• Monitor server logs for unusual activity, particularly unexpected PHP execution or connections from unknown IP addresses.
• Prepare to isolate affected servers from the network immediately if you detect signs of unauthorized code execution.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of the plugin are vulnerable?

All versions of the 3D Product Configurator for WooCommerce up to and including 2.16.2 are vulnerable to CVE-2026-103889.

Is authentication required to exploit this flaw?

No, the vulnerability allows unauthenticated attackers to execute code by sending a single POST request to any site URL.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-103889 as critical with a CVSS score of 9.8.