CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-103889 — The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable t...

·Source: NIST NVD

Updated:

Executive Summary

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template w

Analysis

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site. CVSS Score: 9.8. Published: 2026-10-10T05:16:39.130.

Indicators of Compromise (1)

CVE (1)
CVE-2026-103889
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 10, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Breach Roundup: Russian Hackers Hit Ukrainian Grain Firm

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/breach-roundup-image_small-2-a-33182.jpg" align=right hspace=4><b>Also: eMudhra Exits TLS Cert Biz, German Police Probe 2024 Synnovis Cyberattack</b><br>Russian hackers wiped a Ukrainian grain logistics firm, eMudhra killed its TLS certs biz, Germany investigated the 2024 Synnovis hack, OpenCode flaw, another Nikkei breach. A Revo

Bank Info Security
MEDIUMVulnerability

Indian tech company eMudhra announces withdrawal from certificate business after security incident

The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.

The Record
MEDIUMVulnerability

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its

The Hacker News