CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit

🛡️ Description

CVE-2026-3891 is a critical Unauthenticated Arbitrary File Upload vulnerability found in the Pix for WooCommerce WordPress plugin in versions up to and including 1.5.0.

The vulnerability exists in the lkn_pix_for_woocommerce_c6_save_settings functionality due to missing authorization controls and insufficient file type validation. The exploit automates the process of obtaining a valid nonce and demonstrating the unrestricted upload of a PHP file to a web-accessible directory.

By leveraging this vulnerability, an unauthenticated attacker may be able to:

• Upload Arbitrary Files without authenticating to WordPress.
• Upload Files with Dangerous Extensions due to insufficient file type validation.
• Access Uploaded Files directly through a web-accessible plugin directory.
• Achieve Remote Code Execution (RCE) when uploaded PHP files are executed by the affected web server.

---

🚀 Features

• Unauthenticated Exploitation Flow: Does not require valid WordPress user credentials.
• Automatic Nonce Retrieval: Obtains and extracts the required nonce automatically.
• Automated File Upload: Sends the required multipart upload request to the vulnerable AJAX handler.