A critical (CVSS 9.8) flaw affects the payever WooCommerce Gateway plugin for WordPress, in versions up to and including 4.8.0. Under certain conditions, it can let unauthenticated attackers upload an executable PHP file and run code on the server. The full attack chain depends on recovering a token, so not every installation may be exploitable to the same degree.
What Is It
CVE-2026-93754 is an arbitrary file upload flaw (CWE-434) that can lead to remote code execution. Wordfence reported it, and NVD published it on 2026-11-07.
The plugin registers three WooCommerce-API callbacks with no authentication, no capability check and no nonce:
payever_set_sandbox_api_keyspayever_toggle_subscriptionpayever_synchronization_incoming
The plugin's upload_image() routine fetches a remote file and writes it to the public uploads directory. It uses an attacker-controlled basename() and checks the file type only after the write. According to the advisory, this means an unauthenticated attacker who completes the full chain could drop an executable PHP file into the web root and run code.
The NVD description adds two points:
- Recovering a token, which the full attack chain needs, depends on the plugin's outbound validateToken() call to Payever's service. This condition may limit when the RCE path can actually be reached.
- A separate part of the chain can be exploited on its own: an unauthenticated attacker can overwrite the plugin's identity with hard-coded credentials (CWE-862/CWE-798).
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- It can be exploited over the network.
- The attack is not complex.
- No privileges or user interaction are needed.
- Confidentiality, integrity and availability are all fully at risk.
The plugin handles payments on WooCommerce stores, so a compromised site could expose store and customer data.
The supplied data has no CISA KEV entry, so active exploitation is not confirmed. NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: payever
- Product: payever Checkout – Composable Payment Gateway (WordPress plugin
payever-woocommerce-gateway) - Affected versions: all versions up to and including 4.8.0
No CPE entries were supplied.
Patch Status
The supplied NVD record does not name a fixed version. It references a WordPress plugin Trac changeset for payever-woocommerce-gateway (revision 3761918). Administrators should:
- check the Wordfence advisory and the plugin's changelog for a release later than 4.8.0, and update to it
- if no fix is available, consider disabling the plugin
- review the public uploads directory for unexpected PHP files
There is no CISA KEV entry, so no federal required action or due date applies.