CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit 🛡️ 설명 CVE-2026-3891 은 Pix for WooCommerce WordPress 플러그인의 1.5.0 및 이전 버전 에서 발견된 치명적인 인증되지 않은 임의 파일 업로드Unauthenticated Arbitrary File Upload 취약점입니다. 이 취약점은 lknpixforwoocommercec6savesettings 기능에 존재하며, 인증 제어 누락과 불충분한 파일 유형 검증으로 인해 발생합니다. 이 익스플로잇은 유효한...

CVE-2026-3891

Pix for WooCommerce = 1.5.0 - 認証なし任意ファイルアップロード CVE-2026-3891 PoC 📜 説明 CVE-2026-3891 は、WordPress プラグイン Pix for WooCommerce における認証なし任意ファイルアップロードの脆弱性です。このプラグインは、認証なしで証明書ファイルのアップロードを受け付ける AJAX エンドポイント lknpixforwoocommercec6savesettings を公開しています。nonce は、別の公開エンドポイント lknpixforwoocommercegeneratenonce...

CVE-2026-84023

BEAR – Bulk Editor and Products Manager Professional for WooCommerce , a WordPress plugin, is affected in versions before 1.2.2 . The vulnerability stems from the plugin's failure to verify a CSRF nonce or check user capabilities before allowing updates to taxonomy terms. An attacker can modify a...

WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection

WordPress Pricing Deals for WooCommerce plugin through 2.0.2.02 contains a SQL injection vulnerability. The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or...

VidShop for WooCommerce <= 1.1.4 - SQL Injection

VidShop – Shoppable Videos for WooCommerce plugin for WordPress = 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-0702 info: name: VidShop for WooCommerce =...

CVE-2024-50510

CVE-2024-50510 AR For WooCommerce = 6.2 - 認証なし任意ファイルアップロード 説明 WordPress用AR for WooCommerceプラグインは、バージョン6.2までの全てのバージョンにおいて、ファイルタイプの検証が欠如しているため、任意のファイルアップロードに対して脆弱です。これにより、認証されていない攻撃者が影響を受けるサイトのサーバーに任意のファイルをアップロードする可能性があり、リモートコード実行が可能になる場合があります。 詳細 タイプ : プラグイン スラッグ : ar-for-woocommerce 影響を受けるバージョン :...

CVE-2026-3891

🚀 CVE-2026-3891 – Pix for WooCommerce 未認証ファイルアップロードによる RCE CVE-2026-3891 の概念実証（PoC）エクスプロイト – WordPress プラグイン Pix for WooCommerce （≤ 1.5.0）における未認証の任意ファイルアップロードからリモートコード実行に至る脆弱性です。 📖 概要 CVE-2026-3891 は、Pix for WooCommerce プラグインにおける深刻な脆弱性で、1.5.0 までの全バージョンに影響します。このプラグインは AJAX ハンドラー...

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

EUVD-2026-76038

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lknpixforwoocommercec6savesettings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated...

WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Arif Shaikh in WordPress Plugin Deposits and Partial Payments for WooCommerce versions = 3.1.0...

CVE-2025-11391

PPOM for WooCommerce prefix . PPOMTABLEMETA . " WHERE productmetaid = $metaid"; $res = $wpdb-getrow $qry ; return $res;...

PT-2026-89262

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

CVE-2026-47100-Analysis-Lab

CVE-2026-47100 — FunnelKit / Funnel Builder for WooCommerce 체크아웃 저장형 XSS 실습 환경 로컬 Docker 실습 환경으로 CVE-2026-47100을 안전하고 최소 피해 방식으로 재현합니다. 이 실습 환경은 취약한 FunnelKit 버전과 패치된 버전을 비교하고, 무해한 JavaScript 마커/알림을 사용하여 동작을 확인합니다. 1. 개요 CVE-2026-47100은 버전 3.15.0.3 이전의 Funnel Builder / FunnelKit for WooCommerce...

CVE-2026-3891-Linux

root@kitploit: ███████╗██████╗ ██╗███████╗███╗ ██╗██████╗ ███████╗ ██╔════╝██╔══██╗██║██╔════╝████╗ ██║██╔══██╗██╔════╝ █████╗ ██████╔╝██║█████╗ ██╔██╗ ██║██║ ██║███████╗ ██╔══╝ ██╔══██╗██║██╔══╝ ██║╚██╗██║██║ ██║╚════██║ ██║ ██║ ██║██║███████╗██║ ╚████║██████╔╝███████║ ╚═╝ ╚═╝ ╚═╝╚═╝╚══════╝╚═╝...

WordPress Payment Plugins for Stripe WooCommerce plugin < 4.0.12 - Unauthenticated Customer PII Disclosure vulnerability

Unauthenticated Customer PII Disclosure vulnerability discovered by m1w34p0n in WordPress Plugin Stripe For WooCommerce versions 4.0.12...

CVE-2025-11391

PPOM for WooCommerce prefix . PPOMTABLEMETA . " WHERE productmetaid = $metaid"; $res = $wpdb-getrow $qry ; return $res;...

CVE-2026-84849

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...

CVE-2026-84849 WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...

EUVD-2026-70597

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...