CVE-2026-103889: 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization of the xpvimage POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. The affected handler is reachable through a single POST request to any URL on the site, with no authentication or nonce validation enforced.
Are default deployments affected?
The vulnerable behavior is present in all plugin versions through 2.16.2. The described endpoint does not require a logged-in WordPress user or a special authenticated configuration.
What input is used to trigger code execution?
The attacker-controlled xpv_image POST parameter is inserted unescaped into a Dompdf-rendered HTML template where PHP execution is enabled. This allows supplied content to lead to server-side code execution.