CVE-2026-93754: payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

Q: Who can exploit this issue?

An unauthenticated remote attacker can reach the affected WooCommerce API callbacks because they have no authentication, capability check, or nonce protection. Successful remote code execution also relies on the attacker being able to cause the plugin to fetch and write an attacker-controlled file.

Q: Are default public WordPress uploads exposed to executable-file placement?

The vulnerable upload routine writes the remotely fetched file into the public uploads directory using an attacker-controlled basename before validating its type. An attacker can use this behavior to write an executable PHP file.

Q: Does the full remote-code-execution chain have an external dependency?

Yes. The token-recovery portion of the full chain depends on the plugin's outbound validateToken() call to Payever's service. Separately, the unauthenticated hard-coded-credential identity overwrite issue is independently exploitable.

Q: Which callbacks should defenders investigate for unauthenticated access?

Investigate payever_set_sandbox_api_keys, payever_toggle_subscription, and payever_synchronization_incoming. These WooCommerce API callbacks are identified as lacking authentication, capability checks, and nonce validation.

Published Nov 7, 2026

Updated

The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payeversetsandboxapikeys, payevertogglesubscription, payeversynchronizationincoming) are registered with no authentication, capability check, or nonce, and the uploadimage() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:29 AM

Data Sourced

via MITRE·02:29 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated remote attacker can reach the affected WooCommerce API callbacks because they have no authentication, capability check, or nonce protection. Successful remote code execution also relies on the attacker being able to cause the plugin to fetch and write an attacker-controlled file.

Are default public WordPress uploads exposed to executable-file placement?

The vulnerable upload routine writes the remotely fetched file into the public uploads directory using an attacker-controlled basename before validating its type. An attacker can use this behavior to write an executable PHP file.

Does the full remote-code-execution chain have an external dependency?

Yes. The token-recovery portion of the full chain depends on the plugin's outbound validateToken() call to Payever's service. Separately, the unauthenticated hard-coded-credential identity overwrite issue is independently exploitable.

Which callbacks should defenders investigate for unauthenticated access?

Investigate payever_set_sandbox_api_keys, payever_toggle_subscription, and payever_synchronization_incoming. These WooCommerce API callbacks are identified as lacking authentication, capability checks, and nonce validation.

CVE-2026-93754: payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

Event History

Frequently Asked Questions

Who can exploit this issue?

Are default public WordPress uploads exposed to executable-file placement?

Does the full remote-code-execution chain have an external dependency?

Which callbacks should defenders investigate for unauthenticated access?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are default public WordPress uploads exposed to executable-file placement?

Does the full remote-code-execution chain have an external dependency?

Which callbacks should defenders investigate for unauthenticated access?