payever - WooCommerce Gateway: Unauthenticated remote code execution (CVE-2026-93754)

The payever - WooCommerce Gateway plugin for WordPress (versions 4.8.0 and below) is vulnerable to an arbitrary file upload flaw that leads to remote code execution (RCE). The plugin exposes three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) that lack authentication, authorization, or nonce verification.

The upload_image() routine within these callbacks fetches a file from a remote URL and writes it to the public WordPress uploads directory. Because the filename is derived from attacker-controlled input using basename() before the file type is validated, an attacker can force the plugin to write an executable PHP file to the server.

Impact

An unauthenticated remote attacker can upload arbitrary PHP scripts to the web server, leading to full remote code execution.

Recommendation

• Update the "payever - WooCommerce Gateway" plugin to the latest available version beyond 4.8.0.
• Implement access controls or WAF rules to restrict access to the WooCommerce API callbacks mentioned.
• Audit the /wp-content/uploads/ directory for suspicious PHP files or scripts that were uploaded recently.