What is the CVSS score of CVE-2026-3891?

CVE-2026-3891 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-3891?

A critical vulnerability in the Pix for WooCommerce WordPress plugin allows unauthenticated attackers to upload malicious files and execute arbitrary code on affected websites.

How to fix or mitigate CVE-2026-3891?

Within 24 hours: Audit all WordPress installations for Pix for WooCommerce plugin presence and version; immediately disable the plugin if found until mitigation is confirmed. Within 7 days: Implement compensating controls listed below, review access logs for unauthorized file uploads, and prepare incident response plan. Within 30 days: Monitor vendor for patch release and schedule immediate deployment upon availability; consider alternative payment gateway solutions if patch timeline extends beyond 30 days.

WordPress CVE-2026-3891

EUVD-2026-11760 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-13 Wordfence

File Upload RCE WordPress

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 07:58 euvd

EUVD-2026-11760

Analysis Generated

Mar 13, 2026 - 07:58 vuln.today

CVE Published

Mar 13, 2026 - 07:23 nvd

CRITICAL 9.8

DescriptionCVE.org

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.