CVE-2026-93754
Deferred Deferred - Pending Action

Arbitrary File Upload in Payever WooCommerce Gateway Plugin

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: Wordfence

Description
The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-93754
EUVD
EUVD-2026-118549

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
payever payever Checkout – Composable Payment Gateway From 0 (inc) to 4.8.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The payever – WooCommerce Gateway plugin for WordPress has a vulnerability that allows unauthenticated attackers to upload arbitrary files and execute remote code. Three API callbacks lack authentication checks, and an attacker-controlled file upload routine writes files to the public uploads directory before validating the file type. This enables writing executable PHP files and achieving remote code execution.

Detection Guidance

Check for unauthorized PHP files in the WordPress uploads directory, particularly those with suspicious names or recent timestamps. Review server access logs for requests to the vulnerable API endpoints: payever_set_sandbox_api_keys, payever_toggle_subscription, or payever_synchronization_incoming.

Impact Analysis

An attacker could exploit this to upload malicious files to your WordPress site, gain control over it, steal data, or use it for further attacks. Since no authentication is required, any visitor could potentially compromise your site if the plugin is installed and vulnerable.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face legal penalties, fines, or reputational damage if exploited.

Mitigation Strategies

Immediately update the payever – WooCommerce Gateway plugin to the latest version if available. If not, disable the plugin until a patch is released. Restrict write permissions to the uploads directory and monitor for unauthorized file uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93754. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...