CVE-2026-93754

Summary

The payever WooCommerce Gateway plugin allows unauthenticated remote code execution because three API callbacks lack authentication and capability checks, and an upload_image() function writes attacker-controlled files to the public uploads directory before validating file type, enabling arbitrary PHP file upload.

Exploitability

Exploitation is straightforward for unauthenticated attackers since no authentication, capability, or nonce protection is required on the vulnerable endpoints.

Blast radius

Successful exploitation grants full remote code execution with the privileges of the web server, enabling complete compromise of confidentiality, integrity, and availability of the affected WordPress site.

Detection

Look for POST requests to /wp-json/wc/v3/payever/* endpoints (or similar REST routes) from unauthenticated sources that include file upload parameters, especially with .php extensions or suspicious content types, and monitor the wp-content/uploads directory for newly created PHP files with unusual names or timestamps coinciding with such requests.

Prioritized remediation

Upgrade to payever – WooCommerce Gateway version 4.8.1 or later, which addresses the vulnerability by adding authentication, capability checks, nonce validation, and proper file type validation before writing files to the uploads directory.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.