Expivi 3D Configurator CVE-2026-103889

No special conditions beyond having the plugin installed - the Expivi 3D Product Configurator for WooCommerce (≤2.16.2) is exploitable in its default state because the wp_loaded handler's authentication and nonce check is entirely enclosed in a block comment with no replacement, making the endpoint reachable by any unauthenticated POST to any URL on the site. The concrete prerequisite is simply that the plugin is active; the xpv_image POST parameter is passed unsanitized into a Dompdf-rendered .phtml template that has PHP execution enabled, so no admin access, authentication, user interaction, or non-default setting is required. The only real limiting factor is deployment scope: the site must run this specific plugin at or below version 2.16.2.

All signals align toward a genuine top-priority flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated, no-interaction exploitation with full C/I/A impact (9.8), and the description independently corroborates every one of those metrics: a wp_loaded handler whose only nonce/authentication check is entirely commented out, reachable via a single unauthenticated POST to any site URL, with attacker-controlled input echoed unescaped into a Dompdf template that has PHP execution enabled - a direct, reliable RCE primitive rather than a theoretical one. This is a case where the description makes the high CVSS more credible, not less. The key limiting factor is scope of exposure rather than difficulty: EPSS is not provided, the CVE is NOT listed in CISA KEV, and no public POC is indicated, so there is no evidence of active exploitation yet. Risk is therefore driven by trivially-weaponizable mechanics against a specialized plugin rather than by observed mass exploitation; absent EPSS/KEV data, treat exploitation likelihood as inferred-high-but-unconfirmed. Missing data to note explicitly: no EPSS score, no KEV entry, and no POC signal were supplied, so exploitation probability cannot be quantified from the input.

An unauthenticated attacker sends a single crafted POST request to any URL on a WordPress site running the Expivi 3D Product Configurator (≤2.16.2), setting the xpv_image parameter to a PHP payload. Because the wp_loaded handler's auth/nonce check is commented out and the value is echoed unescaped into a Dompdf template with PHP execution enabled, the payload is executed server-side, yielding arbitrary code execution. No public exploit is identified at time of analysis, but the described path is deterministic and requires no authentication or user interaction.