3D Product Configurator For Woocommerce
Monthly
Unauthenticated remote code execution affects Expivi 3D Product Configurator for WooCommerce through version 2.16.2. Missing authentication and nonce checks on the wp_loaded handler, combined with unsanitized xpv_image POST input echoed into a Dompdf-rendered .phtml template with PHP execution enabled, lets any remote attacker execute code on the server. No public exploit identified at time of analysis; CVSS 9.8 and CWE-434 indicate critical, unauthenticated risk.
Unauthenticated remote code execution affects Expivi 3D Product Configurator for WooCommerce through version 2.16.2. Missing authentication and nonce checks on the wp_loaded handler, combined with unsanitized xpv_image POST input echoed into a Dompdf-rendered .phtml template with PHP execution enabled, lets any remote attacker execute code on the server. No public exploit identified at time of analysis; CVSS 9.8 and CWE-434 indicate critical, unauthenticated risk.