CVE-2026-103889

Summary

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.

Published 2026-10-10 · first seen here 2026-10-10

Analysis & write-ups

No technical write-up from a research team yet. Contact Zero checks Unit 42, Google/Mandiant, Microsoft, Talos, CrowdStrike, Rapid7, watchTowr and others several times a day, plus NVD and CISA reference links.

Where it shows in your logs

Server or web application · Unrestricted file upload (web shell) medium confidence

What to look for

New .jsp, .jspx, .aspx, .ashx, .php files in web-served folders
POST to an upload endpoint followed by GET or POST requests to a newly created script file
The application's process (w3wp.exe, java, tomcat, node, php-fpm, httpd, python) starting shells or LOLBins (cmd, powershell, sh, bash, curl, wget, certutil)
New script files in web roots (.jsp, .aspx, .php): a web shell
Requests to unusual URLs on the application from internet IPs right before any of the above
Outbound connections from the server to new external IPs

Data sources

Web server and WAF logs · ATT&CK DS0015 Application Log Content

Sentinel: W3CIISLogAppServiceHTTPLogsAzureDiagnostics (Application Gateway / Front Door WAF)_Im_WebSession
Splunk: Web.Webms:iis:autoaccess_combinedWAF / proxy sourcetypes
CrowdStrike: Falcon Next-Gen SIEM: third-party web / WAF / proxy logs

Process creation · ATT&CK DS0009 Process Creation

Sentinel: DeviceProcessEventsSecurityEvent (4688)Sysmon Event ID 1_Im_ProcessCreate
Splunk: Endpoint.ProcessesXmlWinEventLog:Microsoft-Windows-Sysmon/OperationalWinEventLog:Security (4688)
CrowdStrike: ProcessRollup2SyntheticProcessRollup2

File creation · ATT&CK DS0022 File Creation

Sentinel: DeviceFileEventsSysmon Event ID 11_Im_FileEvent
Splunk: Endpoint.FilesystemSysmon Event ID 11
CrowdStrike: NewExecutableWrittenNewScriptWritten*FileWritten events

Network connections · ATT&CK DS0029 Network Connection Creation / Network Traffic Flow

Sentinel: DeviceNetworkEventsCommonSecurityLog (firewall)_Im_NetworkSession
Splunk: Network_Traffic.All_TrafficFirewall sourcetypes (pan:traffic, fortigate_traffic, cisco:asa)
CrowdStrike: NetworkConnectIP4NetworkReceiveAcceptIP4NetworkConnectIP6