 ███████╗██████╗ ██╗███████╗███╗   ██╗██████╗ ███████╗
 ██╔════╝██╔══██╗██║██╔════╝████╗  ██║██╔══██╗██╔════╝
 █████╗  ██████╔╝██║█████╗  ██╔██╗ ██║██║  ██║███████╗
 ██╔══╝  ██╔══██╗██║██╔══╝  ██║╚██╗██║██║  ██║╚════██║
 ██║     ██║  ██║██║███████╗██║ ╚████║██████╔╝███████║
 ╚═╝     ╚═╝  ╚═╝╚═╝╚══════╝╚═╝  ╚═══╝╚═════╝ ╚══════╝

 ███████╗██╗  ██╗██████╗ ██╗      ██████╗ ██╗████████╗
 ██╔════╝╚██╗██╔╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝
 █████╗   ╚███╔╝ ██████╔╝██║     ██║   ██║██║   ██║
 ██╔══╝   ██╔██╗ ██╔═══╝ ██║     ██║   ██║██║   ██║
 ███████╗██╔╝ ██╗██║     ███████╗╚██████╔╝██║   ██║
 ╚══════╝╚═╝  ╚═╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝

🛡️ FriendsExploit — CVE-2026-3891

`Pix for WooCommerce <= 1.5.0 — Unauthenticated Arbitrary File Upload`

📖 Description

⚡ This tool exploits CVE-2026-3891, a critical unauthenticated arbitrary file upload vulnerability found in the Pix for WooCommerce WordPress plugin (versions ≤ 1.5.0).

An unauthenticated attacker can upload arbitrary files (e.g., PHP web shells) to the target server without any authentication, leading to Remote Code Execution (RCE).

⚠️ DISCLAIMER

This tool is intended for authorized penetration testing and educational purposes only. Do not use this tool against systems you do not own or have explicit written permission to test. Unauthorized use is illegal.

🔍 CVE Details

🆔 CVE ID	`CVE-2026-3891`
🔌 Plugin	Pix for WooCommerce
🎯 Affected	Versions ≤ 1.5.0
🔓 Type	Unauthenticated Arbitrary File Upload
💥 Impact	Remote Code Execution (RCE)
⚠️ CVSS	Critical

⚙️ Requirements

Requirement	Version	Notes
🐍 Python	3.8+	Required
🖥️ Kali Linux	Any version	Recommended
📦 PyQt5	≥ 5.15.9	GUI framework
🌐 requests	≥ 2.31.0	HTTP library
🔗 urllib3	≥ 2.2.0	URL handling

📥 Installation

# 📂 Clone or download the tool
cd "CVE-2026-3891-Linux"

# 🐍 Create a virtual environment
python3 -m venv venv

# ▶️ Activate the virtual environment
source venv/bin/activate

# 📦 Install dependencies
pip install -r requirements.txt

🚀 Quick Start

Method 1 — Auto Launcher (Recommended)

chmod +x run.sh
./run.sh

run.sh will automatically check Python3, create venv, install dependencies, verify PyArmor, and launch the tool.

Method 2 — Manual Run

source venv/bin/activate
python3 CVE-2026-3891.py

Method 3 — Run with English Translation

source venv/bin/activate
python3 patch_runner.py

🖱️ GUI Instructions

#	Step	Description
1	🎯 Targets	Enter target URL(s) comma-separated or browse to a `.txt` file
2	🐚 Shell File (.php)	Enter the PHP shell filename (default: `shell.php`)
3	📄 Output File	Specify output file for successful shells (default: `shells.txt`)
4	🧵 Threads	Set number of concurrent threads (max: 50)
5	▶️ Start Exploit	Click to begin the exploitation process
6	⏹️ Stop	Click to halt execution at any time
7	🧹 Clear Log	Click to clear the output log

📁 File Structure

CVE-2026-3891-Linux/
├── 📜 CVE-2026-3891.py        # Main exploit script (PyArmor encrypted)
├── 📂 pyarmor_runtime_000000/  # PyArmor runtime (required)
├── 🔄 patch_runner.py          # Translation wrapper (Indonesian → English)
├── 🧪 patch_test.py            # Alternative translation via Qt hooks
├── 🚀 run.sh                   # Auto launcher (recommended)
├── 📋 requirements.txt         # Python dependencies
├── 🐍 venv/                    # Virtual environment (auto-created)
└── 📖 README.md                # This file

⚠️ Important: The pyarmor_runtime_000000/ folder must always be in the same directory as CVE-2026-3891.py. Do not move or delete it.

🔄 Translation Layer

The main exploit (CVE-2026-3891.py) has Indonesian UI strings. Two translation wrappers are included:

File	Method	Status
`patch_runner.py`	Scans widgets every 500ms and replaces text	✅ Recommended
`patch_test.py`	Hooks Qt `setText`/`setPlaceholderText` methods	🧪 Testing

Both translate Indonesian labels and placeholders to English before display.

📝 Notes

📄 Results are saved to shells.txt by default.
🐚 Make sure your PHP shell file (shell.php) is placed in the same directory before running.
🖥️ On Kali Linux, always use a virtual environment to avoid system Python conflicts.
🔒 The main exploit script is PyArmor protected — source code is encrypted.

👨‍💻 Developer & Collaboration

WILLY JR. CARNASA GAILO
_{🔬 Security Researcher}
_{💻 Developer & Exploit Author}

💡 "Building tools for authorized security research and responsible disclosure."

CVE-2026-3891-Linux

Most Popular