CVE-2026-103889 expivi CVE debrief

Who should care

Administrators of WordPress sites using the 3D Product configurator for WooCommerce plugin, security teams responsible for monitoring and patching vulnerabilities, and developers who may need to verify and remediate affected code.

Why it matters

CVE-2026-103889 is a critical vulnerability in the 3D Product configurator for WooCommerce plugin for WordPress, allowing for unauthenticated remote code execution. Administrators and security teams should prioritize patching and verification to prevent potential exploitation and impact on site security and data integrity.

• Potential for unauthenticated remote code execution on affected systems
• Need for immediate patching to prevent exploitation
• Potential impact on site security and data integrity
• Verification of wp_loaded handler and xpv_image parameter sanitization required

Technical summary

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled.

Defensive priority

High priority for patching and verification

Recommended defensive actions

• Patch the 3D Product configurator for WooCommerce plugin to version greater than 2.16.2
• Verify that the wp_loaded handler has proper authentication and nonce checks
• Ensure proper sanitization of the xpv_image POST parameter
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and parameters. However, there is limited information on potential exploits or attacks. To verify, defenders should check for affected product deployments, review official advisories, and monitor for exploitation attempts. The vulnerability allows unauthenticated remote code execution via the 'xpv_image' parameter, with no authentication and nonce checks, and no sanitization of the POST parameter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.