Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-3891 — Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload (CVE-2026-3891) PoC | Kitploit
Tools/GitHubGitHub/joshuavanderpoll/cve-2026-3891
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRemote Access Tool
GitHubjoshuavanderpoll/cve-2026-3891

CVE-2026-3891

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload (CVE-2026-3891) PoC

View Repository
515 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
Website

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload (CVE-2026-3891) PoC

Python

📜 Description

CVE-2026-3891 is an unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin. The plugin exposes an AJAX endpoint (lkn_pix_for_woocommerce_c6_save_settings) that accepts certificate file uploads without any authentication. A nonce can be obtained unauthenticated via a second exposed endpoint (lkn_pix_for_woocommerce_generate_nonce), allowing a fully unauthenticated attacker to upload arbitrary files — including PHP webshells — directly to the web root.

Affected versions: payment-gateway-pix-for-woocommerce <= 1.5.0

✨ Features

  • Unauthenticated — No credentials or session required
  • Auto nonce retrieval — Fetches a valid WordPress nonce without authentication
  • PHP webshell upload — Uploads a webshell to a predictable, web-accessible path
  • Interactive shell — Drop into a live shell session on the target after exploitation
  • Single command mode — Run a one-off command and exit with --command

OSX/Linux

root@kitploit:~
git clone https://github.com/joshuavanderpoll/CVE-2026-3891.git
cd CVE-2026-3891
python3 -m venv .venv
source .venv/bin/activate
pip3 install -r requirements.txt

Windows

root@kitploit:~
git clone https://github.com/joshuavanderpoll/CVE-2026-3891.git
cd CVE-2026-3891
python3 -m venv .venv
.venv\Scripts\activate
pip3 install -r requirements.txt

⚙️ Usage

root@kitploit:~
python3 CVE-2026-3891.py --url <TARGET_URL> [--command <CMD>] [--timeout <SECONDS>] [--useragent <UA>]

Interactive Shell

Exploit the target and drop into a persistent interactive shell session to run multiple commands.

root@kitploit:~
python3 CVE-2026-3891.py --url 'https://target.com'

Interactive shell

Single Command

Run a single command on the target and print the output, useful for scripting or quick checks.

root@kitploit:~
python3 CVE-2026-3891.py --url 'https://target.com' --command whoami

Single command

🐋 Docker PoC

A self-contained Docker Compose environment with the vulnerable software for local testing. Check DOCKER.md for more details

root@kitploit:~
cd docker/
docker compose up -d
python3 CVE-2026-3891.py --url 'http://localhost:8080'

🕵🏼 References

  • Pix for WooCommerce — WordPress Plugin
  • NVD — CVE-2026-3891
  • WordFence
  • HackIndex.io — CVE-2026-3891

📢 Disclaimer

This tool is provided for educational and research purposes only. The creator assumes no responsibility for any misuse or damage caused by this tool.

Download Tool