External risk intelligence

3D Product Configurator for WooCommerce Unauthenticated Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-103889

The vulnerability exists in a WordPress plugin designed for public-facing e-commerce websites. Because it is a web plugin that processes requests directly on the site, and the vulnerable endpoint is reachable via unauthenticated POST requests, it is commonly deployed as part of an internet-facing web application.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress plugin used for product configuration, potentially allowing unauthenticated attackers to execute arbitrary code on servers. This issue stems from insufficient security checks within the plugin's handling of image parameters, which can be exploited remotely. The core concern is confirming if this specific plugin is in use and, if so, determining the extent of exposure.

Unauthenticated code execution in a product configurator.
Key to verify if the plugin is in use.
Assess exposure and consider immediate mitigation.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can execute arbitrary code on a WordPress server by sending a POST request to any URL on the site. This request targets a vulnerable feature within the 3D Product Configurator for WooCommerce plugin, which processes an image parameter without proper checks. The plugin then uses this unsanitized input in a PDF generation process that allows for PHP execution, leading to a compromise of the server.

No authentication or special access needed.
POST request with an image parameter.
Unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an unauthenticated attacker to execute arbitrary code on the server. This is possible because the plugin fails to properly authenticate or validate requests before processing user-supplied data that is then used in a way that enables code execution. This could impact the integrity and availability of the affected WordPress site.

Server-side code execution.
Unauthenticated POST request.
Compromise of site integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

WordPress site owners and application administrators are likely responsible for addressing this vulnerability. The first practical step is to identify all instances of the affected WooCommerce plugin, confirm if they are internet-facing or process sensitive data, and then coordinate with the platform or infrastructure team to plan remediation, potentially involving vendor coordination for updates.

Application owners should manage this issue.
Verify plugin presence and exposure first.
Coordinate vendor updates and plan remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the 3D Product Configurator for WooCommerce plugin?

It is a WordPress extension that enables interactive, 3D visualization of items for online stores. By integrating directly into WooCommerce, it allows shoppers to customize products visually. Because it handles complex configuration data and generates dynamic documents like PDFs, it includes specialized server-side logic to process these requests.

How does CVE-2026-103889 lead to Remote Code Execution?

This vulnerability falls under the Unrestricted Upload or File Inclusion class (CWE-434). The plugin takes user-supplied input from the 'xpv_image' parameter and embeds it into an HTML template for PDF generation. Because this template engine permits PHP execution and the plugin fails to sanitize the input or check for authentication, an attacker can supply malicious code that the server processes and runs.

Do I need special access to trigger this vulnerability?

No. The plugin lacks active authentication or nonce checks on the affected handler, meaning it does not verify the identity of the request sender. Consequently, simply sending a specially crafted POST request to any URL on the affected WordPress site is enough to trigger the flaw. Standard GET requests or requests that do not target this specific parameter will not trigger the vulnerability.

Is my site at risk according to Halo Surface Signal?

Yes, if you run this plugin, the risk is elevated. Halo Surface Signal identifies this as an external threat because the plugin is designed for public-facing e-commerce websites and the vulnerable endpoint is reachable via the internet. Since the flaw does not require an attacker to have a pre-existing user account, any publicly accessible site using the affected versions is a potential target.

How do I start securing my site against this issue?

Begin by auditing your site to confirm if you have the 3D Product Configurator for WooCommerce installed and if it is active. Since this vulnerability affects versions up to 2.16.2, your primary goal is to determine if you are running an outdated version. Review your plugin dashboard, consult your infrastructure team to check for available updates, and prepare to update or disable the plugin immediately.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.