CVE-2026-103889

Name of the Vulnerable Software and Affected Versions 3D Product configurator for WooCommerce versions prior to 2.16.3

Description Remote Code Execution is possible due to missing authentication and nonce checks on the wp loaded handler. The issue occurs because the xpv image POST parameter is not sanitized before being echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This allows unauthenticated attackers to execute arbitrary code on the server via a single POST request to any URL on the site.

Recommendations Update to a version newer than 2.16.2. Avoid using the xpv image parameter until the software is updated.