Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-3891 — Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload | Kitploit
Tools/GitHubGitHub/nxploited/cve-2026-3891
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHubnxploited/cve-2026-3891

CVE-2026-3891

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

View Repository
634 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-3891

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

💣 Pix for WooCommerce <= 1.5.0 – Unauthenticated Arbitrary File Upload (CVE-2026-3891)

👤 Nxploited

🧩 Description

The Pix for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file upload due to:

  • Missing capability check
  • Missing file type validation

in the lkn_pix_for_woocommerce_c6_save_settings function in all versions up to and including 1.5.0.

This allows remote unauthenticated attackers to upload arbitrary files, leading to Remote Code Execution (RCE).

  • CVE: CVE-2026-3891
  • CVSS: 9.8 (Critical)

🧪 PoC / Exploit Script

  • Script: CVE-2026-3891.py
  • Author: Khaled Alenazi (Nxploited) – Nxploited ZeroDay Hub
  • Telegram: @Kxploit
  • Channel: https://t.me/KNxploited

⚙️ Features

  • 🔥 Fully automated exploitation
  • ⚡ Multi-threaded (high-speed scanning)
  • 🎯 Bulk target support (lists)
  • 🧠 Smart nonce extraction
  • 📦 Automatic shell deployment
  • 📊 Live progress tracking
  • 🧾 Auto-save shells to file

⚙️ Requirements

  • Python 3.x
  • Dependencies:
root@kitploit:~
pip install requests rich

🚀 Usage

1️⃣ Prepare Targets

Create a file:

root@kitploit:~
list.txt

Example:

root@kitploit:~
http://example.com
https://target.com
victim-site.com

If protocol is missing → script auto-adds http://

2️⃣ Add Your Shell

Put your shell file in same directory:

root@kitploit:~
shell.php

3️⃣ Run Exploit

root@kitploit:~
python3 CVE-2026-3891.py

4️⃣ Interactive Inputs

The script will ask:

  • Targets file (default: list.txt)
  • Threads (default: 8)
  • Shell filename (e.g. shell.php)

⚡ Exploitation Flow

  1. 🎯 Target loaded
  2. 🔑 Nonce requested
  3. 📤 Shell upload
  4. 💥 File uploaded twice
  5. 🔗 Shell path generated automatically

📂 Shell Location

root@kitploit:~
/wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/<shell>.php

📤 Output

✔ Success

  • Displays formatted result
  • Shows:
    • Target
    • Shell path
    • Full URL

❌ Failure

root@kitploit:~
FAIL http://target.com (reason)

📄 Saved Results

root@kitploit:~
shells.txt

📊 Live Progress

root@kitploit:~
Progress 5/20 OK:3 FAIL:2

⚠️ Disclaimer

This project is provided for educational and authorized security testing only.

  • Do NOT use on systems without permission
  • Unauthorized access is illegal
  • The author is NOT responsible for misuse

👤 Author

Nxploited

  • 👨‍💻 Khaled Alenazi
  • 📬 Telegram: @Kxploit
  • 📢 Channel: https://t.me/KNxploited
Download Tool