{"id":"CVE-2026-93754","aliases":["EUVD-2026-118549","GHSA-5w75-33gq-gccg"],"status":"published","title":"payever – WooCommerce Gateway \u003c= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution","description":"The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00872,"percentile":0.59151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2026-11-07T02:29:10Z","modified":"2026-11-07T03:31:17Z","products":[{"vendor":"payever","product":"payever checkout – composable payment gateway"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03412063-d73a-4c5c-8dc6-3e76a5d975a5?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-synchronization.php?rev=3647773#L22"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-synchronization.php?rev=3647773#L116"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/woocommerce-payever-gateway.php?rev=3647773#L145"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/logger/class-payever-logger.php?rev=3647773#L18"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-log-manager.php?rev=3647773#L35"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/management/class-payever-subscription-manager.php?rev=3647773#L79"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/class-payever-synchronization.php?rev=3647773#L683"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/management/class-payever-import-manager.php?rev=3647773#L21"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/actions/class-payever-action-update-product.php?rev=3647773#L448"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/includes/synchronization/actions/class-payever-action-update-product.php?rev=3647773#L547"},{"url":"https://plugins.trac.wordpress.org/browser/payever-woocommerce-gateway/trunk/vendor/payever/core-sdk-php/lib/Payever/Core/Http/Client/CurlClient.php?rev=3647773#L258"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3761918%40payever-woocommerce-gateway\u0026new=3761918%40payever-woocommerce-gateway"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93754"},{"url":"https://github.com/advisories/GHSA-5w75-33gq-gccg"}],"sources":{"cve":[{"id":"CVE-2026-93754","title":"payever – WooCommerce Gateway \u003c= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution","description":"The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.","status":"published","published":"2026-11-07T02:29:10.521Z","modified":"2026-11-08T19:05:25.752Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-07T03:32:21.038338Z"}],"euvd":[{"id":"EUVD-2026-118549","description":"The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.","status":"published","published":"2026-11-07T02:29:10Z","modified":"2026-11-08T19:05:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-07T06:08:32.207523Z"}],"ghsa":[{"id":"GHSA-5w75-33gq-gccg","title":"The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload...","description":"The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.","status":"published","published":"2026-11-07T03:31:11Z","modified":"2026-11-07T03:31:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-07T03:35:32.541373Z"}],"nvd":[{"id":"CVE-2026-93754","description":"The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.","status":"published","published":"2026-11-07T03:17:08.41Z","modified":"2026-11-08T19:17:43.467Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-08T22:11:13.443661Z"}]}}