CVE-2026-3891

CVE-2026-3891 is an arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin, caused by a missing capability check and missing file type validation in the lkn_pix_for_woocommerce_c6_save_settings function in all versions up to and including 1.5.0. Because the settings-saving routine performs no capability or type checks, any unauthenticated visitor can reach it directly over the network and upload files of any type to the affected site's server, with no privileges or user interaction required. Depending on server configuration, an attacker may be able to upload a PHP script or web shell that the server then executes, making remote code execution possible; the CVSS 3.1 score of 9.8 (critical) reflects high impact to confidentiality, integrity, and availability. Any WordPress site running this WooCommerce plugin at version 1.5.0 or earlier is affected, with exposure concentrated in e-commerce stores accepting Brazil's Pix instant payment method. As of this analysis there is no known public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is confirmed, but the elevated EPSS of 25.1% (98th percentile) signals a substantial probability of exploitation within 30 days.

What to do: Update Pix for WooCommerce to the latest vendor release (any version beyond 1.5.0) as soon as the patched version is published; the fixed version number is not yet specified in available advisories, so monitor the vendor and Wordfence announcements. Until patching, deactivate the plugin or block unauthenticated requests to the settings endpoint tied to the lkn_pix_for_woocommerce_c6_save_settings function via WAF rules, and review the uploads directory and web root for unexpected PHP files as well as access logs for unauthenticated POSTs to that endpoint. Prioritize this patch for WooCommerce stores, given the 25.1% EPSS probability of near-term exploitation.