{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-3891/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-3891"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pix for WooCommerce"],"_cs_severities":["critical"],"_cs_tags":["wordpress","rce","cve-2026-3891"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-3891 is a critical vulnerability affecting the Pix for WooCommerce WordPress plugin in versions up to and including 1.5.0. The vulnerability stems from two AJAX actions, \u003ccode\u003elkn_pix_for_woocommerce_generate_nonce\u003c/code\u003e and \u003ccode\u003elkn_pix_for_woocommerce_c6_save_settings\u003c/code\u003e, which lack proper authentication and authorization checks. An unauthenticated attacker can first request a valid security nonce from the public-facing \u003ccode\u003eadmin-ajax.php\u003c/code\u003e endpoint and subsequently use that nonce to trigger the \u003ccode\u003ec6_save_settings\u003c/code\u003e action.\u003c/p\u003e\n\u003cp\u003eThis second action improperly handles file uploads by failing to validate the file type or verify user permissions, permitting the upload of arbitrary PHP files into a publicly accessible directory. The files are stored in \u003ccode\u003ewp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/\u003c/code\u003e, where they can be executed directly by the web server. Successful exploitation grants the attacker remote code execution with the privileges of the web server user, potentially leading to full site takeover, data exfiltration, and establishment of persistent backdoors.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker performs an unauthenticated POST request to \u003ccode\u003ewp-admin/admin-ajax.php\u003c/code\u003e with the action \u003ccode\u003elkn_pix_for_woocommerce_generate_nonce\u003c/code\u003e and \u003ccode\u003eaction_name=lkn_pix_for_woocommerce_c6_settings_nonce\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server returns a valid security nonce in the JSON response.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a multipart POST request to \u003ccode\u003ewp-admin/admin-ajax.php\u003c/code\u003e using the action \u003ccode\u003elkn_pix_for_woocommerce_c6_save_settings\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe request includes the previously acquired nonce and an arbitrary file (e.g., \u003ccode\u003eshell.php\u003c/code\u003e) in the \u003ccode\u003ecertificate_crt_path\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eThe plugin saves the malicious file to \u003ccode\u003ewp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker navigates their browser to the direct URL of the uploaded file to trigger execution.\u003c/li\u003e\n\u003cli\u003eThe server executes the PHP payload, providing the attacker with remote command execution capabilities.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full Remote Code Execution (RCE) on the WordPress server. Attackers can leverage this access to steal sensitive configuration data such as \u003ccode\u003ewp-config.php\u003c/code\u003e, compromise database credentials, exfiltrate customer information, modify system files to plant backdoors, or gain administrative access to the WordPress site. The vulnerability affects all users running Pix for WooCommerce versions 1.5.0 and earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update Pix for WooCommerce to a version later than 1.5.0 that includes the patch for CVE-2026-3891.\u003c/li\u003e\n\u003cli\u003eIf an update is not immediately available, configure the web server to deny PHP execution within the \u003ccode\u003ecerts_c6\u003c/code\u003e directory using \u003ccode\u003e.htaccess\u003c/code\u003e or server configuration blocks.\u003c/li\u003e\n\u003cli\u003eImplement a WAF rule to block requests to \u003ccode\u003eadmin-ajax.php\u003c/code\u003e containing the \u003ccode\u003elkn_pix_for_woocommerce_c6_save_settings\u003c/code\u003e action if initiated by unauthorized sources.\u003c/li\u003e\n\u003cli\u003eAudit the \u003ccode\u003ecerts_c6\u003c/code\u003e directory for any unexpected PHP files and remove them immediately.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect suspicious AJAX requests and potential webshell uploads.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-03T18:11:14Z","date_published":"2026-08-03T18:11:14Z","id":"https://feed.craftedsignal.io/briefs/2026-08-pix-woocommerce-rce/","summary":"A critical vulnerability (CVE-2026-3891) in the Pix for WooCommerce WordPress plugin allows unauthenticated attackers to upload and execute arbitrary PHP files via vulnerable AJAX handlers.","title":"Unauthenticated Remote Code Execution in Pix for WooCommerce","url":"https://feed.craftedsignal.io/briefs/2026-08-pix-woocommerce-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-3891","version":"https://jsonfeed.org/version/1.1"}