Description

The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-07T03:17:08.410Z",
  "pubdate": "2026-11-07T03:17:08.410Z",
  "executiveSummary": "The payever – WooCommerce Gateway plugin for WordPress contains a critical vulnerability allowing unauthenticated remote code execution (RCE).\nAffected versions include 4.8.0 and all prior versions.\nThe vulnerability stems from insecure implementation of WooCommerce-API callbacks, which lack authentication, capability checks, or nonce verification.\nBy leveraging the upload_image() routine, an attacker can force the application to download and store arbitrary files—including malicious PHP scripts—into the public uploads directory.\nThe root cause involves performing file system write operations with attacker-controlled filenames prior to conducting necessary file type validation.\nThis vulnerability poses a severe risk, as it allows unauthenticated remote actors to gain full control over the WordPress environment by executing arbitrary code.\nThe flaw also exposes an independent vulnerability related to hard-coded credential identity overwrites (CWE-862/CWE-798), further expanding the attack surface.\nImmediate remediation is required, as the exploit requires no prior privileges or network-specific authentication, making it trivial for remote exploitation.",
  "technicalDetails": "The vulnerability resides in the implementation of the WooCommerce-API callbacks: payever_set_sandbox_api_keys, payever_toggle_subscription, and payever_synchronization_incoming.\nThese callbacks are registered in the plugin without any form of security gatekeeping, meaning there are no authentication checks, capability requirements (e.g., current_user_can), or CSRF/nonce protections.\nThe core of the RCE exploit lies within the upload_image() function used by these endpoints. The function accepts external input to fetch a file from a remote location and subsequently writes it to the local WordPress uploads directory.\nThe vulnerability is triggered because the plugin utilizes an attacker-provided input for the basename() of the target file. Critically, the server writes this file to the filesystem before performing any validation on the file's extension, MIME type, or content.\nAn attacker can exploit this by crafting a request that provides a malicious PHP script hosted on a remote server. When the plugin processes the request, it saves the file as a .php object in the public-facing directory.\nBecause the web server is configured to execute PHP files within this directory, the attacker can then navigate to the file path to trigger the execution of the injected code, resulting in complete Remote Code Execution (RCE).\nBeyond the RCE vector, the plugin exhibits an independent security failure involving CWE-862 (Missing Authorization) and CWE-798 (Use of Hard-coded Credentials). Specifically, the token-recovery process allows for unauthorized identity overwrites.\nWhile the token-recovery path involves an outbound validateToken() call to the Payever service, the vulnerability identified allows an attacker to bypass legitimate authorization flows entirely through the identity overwrite mechanism.\nThe combination of unauthenticated file uploads and the potential for hard-coded credential exploitation allows for a multi-stage attack: an adversary can first gain a foothold via RCE, then maintain persistence or escalate access by manipulating plugin settings and identity tokens without requiring valid administrative credentials.\nThe attack is remotely exploitable over the internet, requiring only knowledge of the endpoint URL and the ability to influence the arguments parsed by the vulnerable callback functions."
}