Unauthenticated Remote Code Execution in 3D Product Configurator for WooCommerce

The 3D Product configurator for WooCommerce plugin for WordPress (versions 2.16.2 and earlier) is affected by a critical remote code execution vulnerability (CVE-2026-103889). The flaw resides within the plugin's 'wp_loaded' action handler, where an authentication and nonce check were mistakenly commented out, rendering the endpoint reachable by any unauthenticated user.

The plugin processes the 'xpv_image' POST parameter without any sanitization. This value is subsequently passed to the Dompdf library, which is configured with PHP execution enabled. By crafting a specific HTTP POST request, an unauthenticated attacker can inject arbitrary PHP code that the server will execute upon rendering the HTML template. This vulnerability allows for full remote code execution, granting attackers the ability to compromise the WordPress environment, exfiltrate data, or install persistent backdoors.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary code on the underlying web server. This can lead to complete site takeover, unauthorized access to WooCommerce order and customer databases, and the potential for lateral movement within the hosting infrastructure. Organizations relying on this plugin for product visualization face severe risk of site compromise and data loss.

Recommendation

• Update the '3D Product configurator for WooCommerce' plugin to the latest version immediately to remediate CVE-2026-103889.
• If an update is not immediately available, disable the plugin until a patch is applied.
• Enable web application firewall (WAF) rules to inspect HTTP POST requests targeting WordPress sites for suspicious PHP code injection patterns in the 'xpv_image' parameter.
• Monitor web server logs for high volumes of POST requests to site URLs that do not correspond to typical user interaction with the plugin.