willygailo/cve-2026-3891-linux⚡ This tool exploits CVE-2026-3891, a critical unauthenticated arbitrary file upload vulnerability found in the Pix for WooCommerce WordPress plugin (versions ≤ 1.5.0).
███████╗██████╗ ██╗███████╗███╗ ██╗██████╗ ███████╗
██╔════╝██╔══██╗██║██╔════╝████╗ ██║██╔══██╗██╔════╝
█████╗ ██████╔╝██║█████╗ ██╔██╗ ██║██║ ██║███████╗
██╔══╝ ██╔══██╗██║██╔══╝ ██║╚██╗██║██║ ██║╚════██║
██║ ██║ ██║██║███████╗██║ ╚████║██████╔╝███████║
╚═╝ ╚═╝ ╚═╝╚═╝╚══════╝╚═╝ ╚═══╝╚═════╝ ╚══════╝
███████╗██╗ ██╗██████╗ ██╗ ██████╗ ██╗████████╗
██╔════╝╚██╗██╔╝██╔══██╗██║ ██╔═══██╗██║╚══██╔══╝
█████╗ ╚███╔╝ ██████╔╝██║ ██║ ██║██║ ██║
██╔══╝ ██╔██╗ ██╔═══╝ ██║ ██║ ██║██║ ██║
███████╗██╔╝ ██╗██║ ███████╗╚██████╔╝██║ ██║
╚══════╝╚═╝ ╚═╝╚═╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═╝
Pix for WooCommerce <= 1.5.0 — Unauthenticated Arbitrary File Upload
⚡ This tool exploits CVE-2026-3891, a critical unauthenticated arbitrary file upload vulnerability found in the Pix for WooCommerce WordPress plugin (versions ≤ 1.5.0).
An unauthenticated attacker can upload arbitrary files (e.g., PHP web shells) to the target server without any authentication, leading to Remote Code Execution (RCE).
⚠️ DISCLAIMER
This tool is intended for authorized penetration testing and educational purposes only. Do not use this tool against systems you do not own or have explicit written permission to test. Unauthorized use is illegal.
| 🆔 CVE ID | CVE-2026-3891 |
| 🔌 Plugin | Pix for WooCommerce |
| 🎯 Affected | Versions ≤ 1.5.0 |
| 🔓 Type | Unauthenticated Arbitrary File Upload |
| 💥 Impact | Remote Code Execution (RCE) |
| ⚠️ CVSS | Critical |
| Requirement | Version | Notes |
|---|---|---|
| 🐍 Python | 3.8+ | Required |
| 🖥️ Kali Linux | Any version | Recommended |
| 📦 PyQt5 | ≥ 5.15.9 | GUI framework |
| 🌐 requests | ≥ 2.31.0 | HTTP library |
| 🔗 urllib3 | ≥ 2.2.0 | URL handling |
# 📂 Clone or download the tool
cd "CVE-2026-3891-Linux"
# 🐍 Create a virtual environment
python3 -m venv venv
# ▶️ Activate the virtual environment
source venv/bin/activate
# 📦 Install dependencies
pip install -r requirements.txt
chmod +x run.sh
./run.sh
run.shwill automatically check Python3, create venv, install dependencies, verify PyArmor, and launch the tool.
source venv/bin/activate
python3 CVE-2026-3891.py
source venv/bin/activate
python3 patch_runner.py
| # | Step | Description |
|---|---|---|
| 1 | 🎯 Targets | Enter target URL(s) comma-separated or browse to a .txt file |
| 2 | 🐚 Shell File (.php) | Enter the PHP shell filename (default: shell.php) |
| 3 | 📄 Output File | Specify output file for successful shells (default: shells.txt) |
| 4 | 🧵 Threads | Set number of concurrent threads (max: 50) |
| 5 | ▶️ Start Exploit | Click to begin the exploitation process |
| 6 | ⏹️ Stop | Click to halt execution at any time |
| 7 | 🧹 Clear Log | Click to clear the output log |
CVE-2026-3891-Linux/
├── 📜 CVE-2026-3891.py # Main exploit script (PyArmor encrypted)
├── 📂 pyarmor_runtime_000000/ # PyArmor runtime (required)
├── 🔄 patch_runner.py # Translation wrapper (Indonesian → English)
├── 🧪 patch_test.py # Alternative translation via Qt hooks
├── 🚀 run.sh # Auto launcher (recommended)
├── 📋 requirements.txt # Python dependencies
├── 🐍 venv/ # Virtual environment (auto-created)
└── 📖 README.md # This file
⚠️ Important: The
pyarmor_runtime_000000/folder must always be in the same directory asCVE-2026-3891.py. Do not move or delete it.
The main exploit (CVE-2026-3891.py) has Indonesian UI strings. Two translation wrappers are included:
| File | Method | Status |
|---|---|---|
patch_runner.py | Scans widgets every 500ms and replaces text | ✅ Recommended |
patch_test.py | Hooks Qt setText/setPlaceholderText methods | 🧪 Testing |
Both translate Indonesian labels and placeholders to English before display.
shells.txt by default.shell.php) is placed in the same directory before running.
WILLY JR. CARNASA GAILO 🔬 Security Researcher 💻 Developer & Exploit Author 
|
💡 "Building tools for authorized security research and responsible disclosure."
|
|
|
|
|
|
🎯 Sa lahat ng bug bounty hunters at security researchers na nagpo-propose ng responsible disclosure — kayo ang dahilan kung bakit nag-i-improve ang security ng mga web applications.
🙏 Kung may naitulong itong tool sa iyong authorized penetration testing, please consider giving back sa open-source security community.
╔═══════════════════════════════════════════════════════════════╗
║ ║
║ This tool is for AUTHORIZED penetration testing only. ║
║ Always follow responsible disclosure practices. ║
║ Unauthorized use is ILLEGAL and may result in prosecution. ║
║ ║
╚═══════════════════════════════════════════════════════════════╝
© 2026 FriendsExploit | Developed by Willy Jr. Carnasa Gailo
Made with 🛡️ for the security community