CVE-2026-3891
published 2026-03-13CVE-2026-3891: The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the…
PriorityP184critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
25.06%
97.8th percentile
The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linknacional | pix_for_woocommerce | <= 1.5.0 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
linknacional Pix for WooCommerce Plugin up to 1.5.0 on WordPress Setting lkn_pix_for_woocommerce_c6_save_settings unrestricted upload (EUVD-2026-11760 / EDB-52642)
vuldb·2026-08-20·CVSS 9.8
CVE-2026-3891 [CRITICAL] linknacional Pix for WooCommerce Plugin up to 1.5.0 on WordPress Setting lkn_pix_for_woocommerce_c6_save_settings unrestricted upload (EUVD-2026-11760 / EDB-52642)
A vulnerability was found in linknacional Pix for WooCommerce Plugin up to 1.5.0 on WordPress. It has been declared as critical. The affected element is the function lkn_pix_for_woocommerce_c6_save_settings of the component Setting Handler. Executing a manipulation can lead to unrestricted upload.
This vulnerability appears as CVE-2026-3891. The attack may be performed from remote. In addition, an exploit is available.
GHSA
pypdf: Possible infinite loop for not terminated inline images
ghsa·2026-07-23
CVE-2026-59936 [HIGH] CWE-400 pypdf: Possible infinite loop for not terminated inline images
pypdf: Possible infinite loop for not terminated inline images
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example.
### Patches
This has been fixed in [pypdf==6.14.1](https://github.com/py-pdf/pypdf/releases/tag/6.14.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3891](https://github.com/py-pdf/pypdf/pull/3891).
GHSA
GHSA-fpj4-w3j6-3v3w: The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation
ghsa_unreviewed·2026-03-13
CVE-2026-3891 [CRITICAL] CWE-434 GHSA-fpj4-w3j6-3v3w: The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation
The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
No detection rules found.
Exploit-DB
WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
exploitdb·2026-08-17·CVSS 9.8
CVE-2026-3891 [CRITICAL] WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
---
# Exploit Title: WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
# Google Dork: N/A
# Date: 2026-07-15
# Exploit Author: Mohammad Hossein Sadeghian
# Vendor Homepage: https://wordpress.org/plugins/payment-gateway-pix-for-woocommerce/
# Software Link: https://wordpress.org/plugins/payment-gateway-pix-for-woocommerce/
# Version: '
session = requests.Session()
print("\n[*] Requesting nonce...")
try:
response = session.post(
ajax_url,
data={
"action": "lkn_pix_for_woocommerce_generate_nonce",
"action_name": "lkn_pix_for_woocommerce_c6_settings_nonce"
},
timeout=10
)
result = response.json()
nonce = result["data"]["nonce"]
print(f"[+] Nonce obtained: {nonce}")
except Exception as e:
print(f"[-] Failed to obtain nonc
Nuclei
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
nuclei·CVSS 9.8
CVE-2026-3891 [CRITICAL] Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Template:
id: CVE-2026-3891
info:
name: Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
author: m4sh_wacker
severity: critical
description: |
The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in t
Metasploit
WordPress Unauthenticated RCE via Pix for WooCommerce plugin
metasploit
CVE-2026-3891 WordPress Unauthenticated RCE via Pix for WooCommerce plugin
WordPress Unauthenticated RCE via Pix for WooCommerce plugin
This Metasploit module exploits an Unauthenticated Arbitrary File Upload vulnerability in the Pix for WooCommerce plugin for WordPress. Attackers can leverage the missing capability check and insufficient file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function to upload arbitrary files to the affected server, which may lead to remote code execution under the web server's privileges. The affected versions include all releases up to and including 1.5.0.
Rapid7
Metasploit Wrap Up: Lot of summer shells and fit http profiles
blogs_rapid7·2026-08-14·CVSS 10.0
CVE-2026-46300 [CRITICAL] Metasploit Wrap Up: Lot of summer shells and fit http profiles
This wrap-up brings a full-on shell parade. Thirteen shiny new modules landed, starting with a buffet of RCEs. WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, a Pix-for-WooCommerce, and for those who like their exploits closer to the bare-metal, the Fragnesia Linux kernel LPE (CVE-2026-46300). Metasploit also got the glow-up of the summer with the new http malleable profiles, MCP functionality and linux multi fetch payloads (more details on the [official 6.5 release blog post](https://www.rapid7.com/blog/post/pt-metasploit-framework-6-5-released/)!). Windows on ARM confirm to be the new first-class citizenship thanks to brand-new AArch64 reverse-TCP shells (both inline and staged), so your Snapdragon boxes can join the par
Wiz
CVE-2026-3891 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.8
CVE-2026-3891 [CRITICAL] CVE-2026-3891 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-3891 :
WordPress vulnerability analysis and mitigation
The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Source : NVD
## 9.8
Score
Published March 13, 2026
Severity CRITICAL
CNA Score 9.8
Affected Technologies
WordPress
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 21.9
Exploitation Probability (EPSS) 0.1
Affected pa
https://plugins.trac.wordpress.org/browser/payment-gateway-pix-for-woocommerce/tags/1.4.0/Includes/LknPaymentPixForWoocommercePixC6.php#L694https://plugins.trac.wordpress.org/changeset/3480639/payment-gateway-pix-for-woocommerce#file56https://www.wordfence.com/threat-intel/vulnerabilities/id/20188fd3-c330-4c76-912b-72731e14c450?source=cve
2026-03-13
Published