CVE-2026-3891 is a critical vulnerability in the Pix for WooCommerce WordPress plugin caused by unrestricted file upload due to missing capability checks and lack of file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function. This allows unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution. The vulnerability affects all versions up to and including 1.5.0. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented yet.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the affected server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe and could result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the plugin's settings functions, implement manual file upload restrictions if possible, and monitor for suspicious file uploads. Avoid exposing the affected plugin to untrusted users or the public internet where possible.