CVE-2026-93754

Name of the Vulnerable Software and Affected Versions payever – WooCommerce Gateway versions prior to 4.8.1

Description The plugin allows unauthenticated arbitrary file upload, which can lead to remote code execution. Three WooCommerce-API callbacks, 'payever set sandbox api keys', 'payever toggle subscription', and 'payever synchronization incoming', are registered without authentication, capability checks, or nonces. The upload image() function writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() before validating the file type. This allows an unauthenticated attacker to upload and execute a PHP file on the server. Additionally, an unauthenticated hard-coded-credential identity overwrite is independently exploitable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.