CVE-2026-93754: RCE in payever WooCommerce Gateway

Arbitrary file upload and RCE in payever WooCommerce Gateway plugin up to version 4.8.0. CVSS 9.8 critical.

CVE-2026-93754 describes an arbitrary file upload and RCE vulnerability in the payever – WooCommerce Gateway plugin. Three WooCommerce callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered without authentication, capability checks, or nonce validation. The upload_image() routine writes remotely fetched files to the uploads directory using an attacker-controlled basename() BEFORE file type validation, allowing unauthenticated attackers to write an executable PHP file and achieve RCE.

The vulnerability has CVSS 9.8 (critical). Published on NVD on November 7, 2026, it affects the plugin up to version 4.8.0 inclusive and requires no authentication. Three social posts in the past 24 hours discussed the CVE; no patch is yet available. The absence of protections (nonce, authentication, capability checks) combined with RCE makes this an immediate threat to any WordPress installation using this plugin.

Disable or remove the plugin immediately. Monitor the uploads directory and WooCommerce API logs for suspicious activity, looking for POST requests to the three vulnerable endpoints. If available, use WAF to block requests to payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming. Check the filesystem for recently created PHP files and verify if the server has been compromised.

At a glance

What: Arbitrary PHP file upload without file type validation. Three WooCommerce callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are not protected by authentication, capability checks, or nonce. The upload_image() function writes remotely fetched files to the uploads directory using an attacker-controlled basename() BEFORE file type validation.
Severity: CVSS 9.8 (critical). No authentication required. Affects any user, including unauthenticated ones.
Affected versions: All versions of the payever – WooCommerce Gateway plugin up to and including version 4.8.0.
Fix: Not reported.
Status: Published on NVD on November 7, 2026. No official patch is available according to social signals.
Action: 1) Disable or remove the plugin until a patch is available. 2) Monitor the uploads directory and WooCommerce API logs. 3) Search for POST requests to the three vulnerable endpoints in server logs. 4) Implement WAF rules to block requests to these callbacks. 5) Verify filesystem integrity and look for suspicious PHP files.

Sources: NVD, CVE-2026-93754

← All articles