Single POST Request Enables Unauthenticated Code Execution in WooCommerce 3D Plugin

A critical remote code execution flaw in a popular WooCommerce plugin allows unauthenticated attackers to take full control of affected servers. The National Vulnerability Database rates CVE-2026-103889 as critical with a CVSS score of 9.8. The issue impacts the 3D Product configurator for WooCommerce plugin, specifically versions 2.16.2 and earlier.

By the numbers

• 9.8: The CVSS base score assigned by the NVD, indicating the highest level of exploitability and impact.
• 1: The number of unauthenticated POST requests an attacker needs to send to exploit the vulnerability on any URL.
• 2.16.2: The latest version of the 3D Product configurator for WooCommerce plugin that contains this critical security flaw.

What the figures mean

The vulnerability stems from a fundamental failure in how the plugin handles user input and authentication. According to the NVD record, the plugin's wp_loaded handler lacks necessary nonce and authentication checks. The only existing security check is entirely enclosed within a block comment, leaving it inactive. This oversight allows any user, without credentials, to reach the vulnerable endpoint.

Attackers exploit this by sending a POST request with malicious data in the 'xpv_image' parameter. The plugin fails to sanitize this input before echoing it into a Dompdf-rendered HTML template. Because PHP execution is enabled within this template, the unsanitized code runs on the server. This weakness is classified as CWE-434, which relates to unrestricted upload of executable file types or similar code injection issues.

The impact is immediate server compromise. An attacker does not need to guess passwords or bypass complex security layers. A single, properly formatted request is sufficient to execute arbitrary code. This makes scanning for and exploiting this flaw extremely easy for automated bots or manual attackers targeting WordPress installations.

What should you do?

Managed service providers should immediately audit their client portfolios for sites running the 3D Product configurator for WooCommerce plugin. Identify all installations running version 2.16.2 or older. These sites are currently exposed to remote code execution without any authentication barrier.

Verify the current plugin version on each affected site. If the version is 2.16.2 or lower, the site is vulnerable. Monitor server logs for unusual POST requests, particularly those targeting the 'xpv_image' parameter. Look for signs of unauthorized code execution or new files appearing in the Dompdf template directories.

What to do and how to stay safe: CVE-2026-103889

• Scan all managed WordPress sites to identify installations of the 3D Product configurator for WooCommerce plugin and check their version numbers.
• Isolate or take offline any site running version 2.16.2 or earlier until a secure update is available and applied.
• Review server access logs for recent POST requests containing the 'xpv_image' parameter to detect potential exploitation attempts.
• Monitor file integrity on servers for unexpected changes in PHP files or new executable scripts within plugin directories.

General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific plugin version is affected by CVE-2026-103889?

All versions of the 3D Product configurator for WooCommerce plugin up to and including version 2.16.2 are vulnerable.

Do attackers need a login to exploit this flaw?

No, the vulnerability allows unauthenticated access because the authentication checks are commented out in the code.

What is the technical cause of the remote code execution?

The plugin echoes unsanitized 'xpv_image' POST data into a Dompdf template with PHP execution enabled.