███████╗██████╗ ██╗███████╗███╗   ██╗██████╗ ███████╗
 ██╔════╝██╔══██╗██║██╔════╝████╗  ██║██╔══██╗██╔════╝
 █████╗  ██████╔╝██║█████╗  ██╔██╗ ██║██║  ██║███████╗
 ██╔══╝  ██╔══██╗██║██╔══╝  ██║╚██╗██║██║  ██║╚════██║
 ██║     ██║  ██║██║███████╗██║ ╚████║██████╔╝███████║
 ╚═╝     ╚═╝  ╚═╝╚═╝╚══════╝╚═╝  ╚═══╝╚═════╝ ╚══════╝

 ███████╗██╗  ██╗██████╗ ██╗      ██████╗ ██╗████████╗
 ██╔════╝╚██╗██╔╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝
 █████╗   ╚███╔╝ ██████╔╝██║     ██║   ██║██║   ██║
 ██╔══╝   ██╔██╗ ██╔═══╝ ██║     ██║   ██║██║   ██║
 ███████╗██╔╝ ██╗██║     ███████╗╚██████╔╝██║   ██║
 ╚══════╝╚═╝  ╚═╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝

📖 Description

⚡ This tool exploits CVE-2026-3891, a critical unauthenticated arbitrary file upload vulnerability found in the Pix for WooCommerce WordPress plugin (versions ≤ 1.5.0).

An unauthenticated attacker can upload arbitrary files (e.g., PHP web shells) to the target server without any authentication, leading to Remote Code Execution (RCE).

🔍 CVE Details

⚙️ Requirements

📥 Installation

# 📂 Clone or download the tool
cd "CVE-2026-3891-Linux"

# 🐍 Create a virtual environment
python3 -m venv venv

# ▶️ Activate the virtual environment
source venv/bin/activate

# 📦 Install dependencies
pip install -r requirements.txt

🚀 Quick Start

Method 1 — Auto Launcher (Recommended)

chmod +x run.sh
./run.sh

run.sh will automatically check Python3, create venv, install dependencies, verify PyArmor, and launch the tool.

Method 2 — Manual Run

source venv/bin/activate
python3 CVE-2026-3891.py

Method 3 — Run with English Translation

source venv/bin/activate
python3 patch_runner.py

🖱️ GUI Instructions

📁 File Structure

CVE-2026-3891-Linux/
├── 📜 CVE-2026-3891.py        # Main exploit script (PyArmor encrypted)
├── 📂 pyarmor_runtime_000000/  # PyArmor runtime (required)
├── 🔄 patch_runner.py          # Translation wrapper (Indonesian → English)
├── 🧪 patch_test.py            # Alternative translation via Qt hooks
├── 🚀 run.sh                   # Auto launcher (recommended)
├── 📋 requirements.txt         # Python dependencies
├── 🐍 venv/                    # Virtual environment (auto-created)
└── 📖 README.md                # This file

⚠️ Important: The pyarmor_runtime_000000/ folder must always be in the same directory as CVE-2026-3891.py. Do not move or delete it.

🔄 Translation Layer

The main exploit (CVE-2026-3891.py) has Indonesian UI strings. Two translation wrappers are included:

Both translate Indonesian labels and placeholders to English before display.

📝 Notes

• 📄 Results are saved to shells.txt by default.
• 🐚 Make sure your PHP shell file (shell.php) is placed in the same directory before running.
• 🖥️ On Kali Linux, always use a virtual environment to avoid system Python conflicts.
• 🔒 The main exploit script is PyArmor protected — source code is encrypted.

👨‍💻 Developer & Collaboration

💡 "Building tools for authorized security research and responsible disclosure."

🙏 Acknowledgments

🎯 Sa lahat ng bug bounty hunters at security researchers na nagpo-propose ng responsible disclosure — kayo ang dahilan kung bakit nag-i-improve ang security ng mga web applications.

🙏 Kung may naitulong itong tool sa iyong authorized penetration testing, please consider giving back sa open-source security community.

╔═══════════════════════════════════════════════════════════════╗
║                                                               ║
║   This tool is for AUTHORIZED penetration testing only.       ║
║   Always follow responsible disclosure practices.             ║
║   Unauthorized use is ILLEGAL and may result in prosecution.  ║
║                                                               ║
╚═══════════════════════════════════════════════════════════════╝