3D Product Configurator: Unauthenticated RCE via xpv_image Affects expivi <=2.16.2
A critical flaw in the 3D Product Configurator plugin allows unauthenticated attackers to execute arbitrary code on WordPress servers via a single POST request.
Key points
- The National Vulnerability Database rates CVE-2026-103889 as critical with a CVSS score of 9.8
- Exploitation requires no authentication and uses the xpv_image parameter to inject code
- Versions 2.16.2 and earlier of the expivi plugin are vulnerable to this remote code execution
The 3D Product Configurator for WooCommerce plugin contains a critical remote code execution vulnerability that allows unauthenticated attackers to control WordPress servers. The National Vulnerability Database assigned CVE-2026-103889 a CVSS score of 9.8, reflecting the severe risk posed by this flaw in versions up to and including 2.16.2.
How it unfolded
- The vulnerability exists because authentication and nonce checks on the wp_loaded handler are missing
- Developers left the only security check inside a block comment without replacing it with functional code
- Attackers can send a single unauthenticated POST request to any URL on the affected site
- The xpv_image parameter is processed without sanitization and echoed unescaped into a template
- Dompdf renders the HTML template with PHP execution enabled, allowing arbitrary code to run
Who is affected
Any WordPress site running the 3D Product Configurator for WooCommerce plugin from vendor expivi is at risk. The vulnerability impacts all versions up to and including 2.16.2. According to the NVD record, the flaw is categorized under CWE-434, indicating improper neutralization of special elements. This classification highlights the failure to handle user input safely before processing it through the server-side rendering engine.
The lack of authentication means that anyone on the internet can attempt to exploit this endpoint. The attack surface is broad because the vulnerable handler responds to POST requests on any URL within the site. This makes targeted attacks easy to automate and difficult to detect based on standard access logs alone.
The fix
No patch has been confirmed yet for this vulnerability. Site administrators should assume that any installation of the plugin versions 2.16.2 or older is compromised if it has been exposed to the internet. Until the vendor releases a corrected version, the risk remains unmitigated. Users should monitor official channels for updates regarding a secure version.
What to do and how to stay safe: WooCommerce
- Scan all managed WordPress environments for the 3D Product Configurator plugin and verify installed versions immediately
- Review server logs for unusual POST requests targeting the wp_loaded handler or containing the xpv_image parameter
- Restrict access to vulnerable endpoints using web application firewalls if the plugin cannot be removed temporarily
- Monitor for unexpected file creation or modification events on the server that may indicate successful exploitation
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-103889?
The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.8.
Which plugin versions are affected by this flaw?
All versions of the 3D Product Configurator for WooCommerce plugin up to and including 2.16.2 are vulnerable.
Does an attacker need login credentials to exploit this?
No, the vulnerability allows unauthenticated attackers to execute code via a single POST request.
