{"id":"CVE-2026-93754","aliases":[],"cve":{"records":[{"id":"CVE-2026-93754","source":"Wordfence","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-18T16:35:16.353Z","published":"2026-11-07T02:29:10.521Z","modified":"2026-11-08T19:05:25.752Z"}],"publishers":[{"name":"Wordfence","role":"CNA","organizationId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","modified":"2026-11-07T02:29:10.521Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-08T19:05:25.752Z"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03412063-d73a-4c5c-8dc6-3e76a5d975a5?source=cve","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-synchronization.php?rev=3647773#L22","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-synchronization.php?rev=3647773#L116","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/woocommerce-payever-gateway.php?rev=3647773#L145","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/logger/class-payever-logger.php?rev=3647773#L18","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-log-manager.php?rev=3647773#L35","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/management/class-payever-subscription-manager.php?rev=3647773#L79","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-synchronization.php?rev=3647773#L683","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/management/class-payever-import-manager.php?rev=3647773#L21","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/actions/class-payever-action-update-product.php?rev=3647773#L448","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/actions/class-payever-action-update-product.php?rev=3647773#L547","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/vendor/payever/core-sdk-php/lib/Payever/Core/Http/Client/CurlClient.php?rev=3647773#L258","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3761918%40payever-woocommerce-gateway&new=3761918%40payever-woocommerce-gateway","tags":[],"source":"Wordfence"}],"weaknesses":[{"id":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","source":"Wordfence"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-08T18:48:39.952813Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution","titleSource":"Wordfence","descriptionSource":"Wordfence","description":"The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.","score":9.8,"severity":"critical","published":"2026-11-07T02:29:10.521Z","modified":"2026-11-08T19:05:25.752Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"payever","name":"payever Checkout – Composable Payment Gateway","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.8.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Wordfence","url":"https://www.cve.org/CVERecord?id=CVE-2026-93754"}],"remediation":[],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/03412063-d73a-4c5c-8dc6-3e76a5d975a5?source=cve","https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-synchronization.php?rev=3647773#L22","https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-synchronization.php?rev=3647773#L116","https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/woocommerce-payever-gateway.php?rev=3647773#L145","https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/logger/class-payever-logger.php?rev=3647773#L18","https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-log-manager.php?rev=3647773#L35","https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/management/class-payever-subscription-manager.php?rev=3647773#L79","https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-synchronization.php?rev=3647773#L683","https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/management/class-payever-import-manager.php?rev=3647773#L21","https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/actions/class-payever-action-update-product.php?rev=3647773#L448","https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/actions/class-payever-action-update-product.php?rev=3647773#L547","https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/vendor/payever/core-sdk-php/lib/Payever/Core/Http/Client/CurlClient.php?rev=3647773#L258","https://plugins.trac.wordpress.org/changeset?reponame=&old=3761918%40payever-woocommerce-gateway&new=3761918%40payever-woocommerce-gateway"],"sources":[{"name":"CVE","id":"CVE-2026-93754","modified":"2026-11-08T19:05:25.752Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93754"}],"assessments":[{"source":"Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-11-08T19:23:26.099Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:00:32.242Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-07T04:20:36.361Z","attemptedAt":"2026-11-07T04:20:36.361Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-07T04:20:36.805Z","attemptedAt":"2026-11-07T04:20:36.805Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-07T04:20:37.521Z","attemptedAt":"2026-11-07T04:20:37.521Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-07T04:20:37.156Z","attemptedAt":"2026-11-07T04:20:37.156Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-93754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93754","modified":"2026-11-07T03:17:08.570","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-07T04:20:36.361Z"},{"source":"GitHub Advisory Database","id":"GHSA-5w75-33gq-gccg","url":"https://github.com/advisories/GHSA-5w75-33gq-gccg","modified":"2026-11-07T03:31:17Z","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-07T04:20:36.805Z"},{"source":"ENISA EUVD","id":"EUVD-2026-118549","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-118549","modified":"Nov 7, 2026, 2:29:10 AM","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-07T04:20:37.521Z"}],"aiSummary":{"text":"The payever – WooCommerce Gateway plugin for WordPress, versions up to 4.8.0, has an arbitrary file upload weakness. An unauthenticated attacker may upload files to the public uploads directory. The impact is uncertain.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-07T03:21:08.019Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-93754"}]}}