CVE-2026-103889: CWE-434 Unrestricted Upload of File with Dangerous Type in expivi 3D Product configurator for WooCommerce

CVE-2026-103889 is a critical remote code execution vulnerability in the expivi 3D Product configurator for WooCommerce plugin for WordPress affecting versions up to 2.16.2. The vulnerability is due to the absence of authentication and nonce verification in the wp_loaded handler and the lack of sanitization of the 'xpv_image' POST parameter. This parameter is directly echoed without escaping into a Dompdf-rendered HTML template with PHP execution enabled, allowing unauthenticated attackers to execute arbitrary code on the server. The only nonce and authentication check present is commented out, leaving the endpoint accessible via a single unauthenticated POST request.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the affected server, leading to full compromise of confidentiality, integrity, and availability. This can result in complete server takeover, data theft, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint if possible and monitor for suspicious POST requests targeting the 'xpv_image' parameter. Avoid using affected versions in production environments.