Threats tagged 'ghsa-m7vx-2p8f-r357'

The expivi 3D Product configurator for WooCommerce plugin for WordPress contains a critical remote code execution vulnerability in all versions up to and including 2.16.2. This flaw arises from missing authentication and nonce checks combined with unsanitized input in the 'xpv_image' POST parameter, which is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. An attacker can exploit this by sending a single unauthenticated POST request to execute arbitrary code on the server.