CVE-2026-3891: 
WordPress vulnerability analysis and mitigation

CVE-2026-3891 is an arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin (by linknacional), affecting all versions up to and including 1.5.0. The flaw resides in the lkn_pix_for_woocommerce_c6_save_settings function, which lacks both a capability check and file type validation, enabling unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution. It was published on March 13, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, ENISA EUVD).

The root cause is a combination of CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-862 (Missing Authorization). The vulnerable function lkn_pix_for_woocommerce_c6_save_settings processes file upload requests without verifying the caller's WordPress capabilities (nonce/role check) and without restricting accepted file extensions or MIME types. An unauthenticated remote attacker can send a crafted HTTP POST request directly to the plugin's AJAX or settings endpoint, supplying a malicious file (e.g., a PHP web shell) that the server stores in a web-accessible directory. Source code evidence of the flaw is visible in the plugin's repository at the affected version (WordPress Trac, WordPress Changeset).

Successful exploitation grants an unauthenticated attacker the ability to upload and execute arbitrary server-side code (e.g., PHP web shells), resulting in full compromise of the affected WordPress installation. This impacts all three security pillars: confidentiality (access to database credentials, user data, and site content), integrity (modification or defacement of site files), and availability (potential for service disruption or ransomware deployment). The compromised server could also serve as a pivot point for lateral movement within the hosting environment (Wordfence, ENISA EUVD).

Multiple public proof-of-concept (PoC) repositories have been published, including exploits by joshuavanderpoll, vladimirmanylobed451, Nxploited, willygailo, and a mass-scanner tool by AnggaTechI. The vulnerability has also been indexed on Sploitus and Vulners, indicating broad availability of weaponized code. The EPSS score is approximately 0.169%, and there is no current CISA KEV catalog listing. Qualys has published a detection (ID: 531109) for this vulnerability (Qualys, Sploitus).

1. Reconnaissance: Use tools like Shodan, Censys, or WPScan to identify WordPress sites running the Pix for WooCommerce plugin version ≤ 1.5.0. Look for the plugin's presence via common paths (e.g., /wp-content/plugins/payment-gateway-pix-for-woocommerce/).
2. Identify the vulnerable endpoint: Target the AJAX action or settings endpoint that invokes lkn_pix_for_woocommerce_c6_save_settings. This function is accessible without authentication due to the missing capability check.
3. Craft the malicious request: Prepare a multipart HTTP POST request containing a PHP web shell (e.g., <?php system($_GET['cmd']); ?>) with a .php extension. No authentication token or nonce is required.
4. Upload the web shell: Send the crafted POST request to the vulnerable endpoint (e.g., https://target.com/wp-admin/admin-ajax.php with the appropriate action parameter). The server accepts and stores the file without validation.
5. Locate the uploaded file: The file is stored in a web-accessible directory under wp-content/ (e.g., wp-content/uploads/ or a plugin-specific subdirectory).
6. Achieve remote code execution: Access the uploaded shell via browser or curl (e.g., https://target.com/wp-content/uploads/shell.php?cmd=id) to execute arbitrary OS commands as the web server user (joshuavanderpoll PoC, Wordfence).

• Network: Unexpected POST requests to wp-admin/admin-ajax.php or plugin-specific endpoints with multipart file upload content from unauthenticated sources; outbound connections from the web server process to unknown external IPs.
• File System: Presence of .php files with unusual names in wp-content/uploads/ or plugin directories (e.g., payment-gateway-pix-for-woocommerce/); newly created files containing system(), exec(), passthru(), shell_exec(), or base64_decode() PHP functions.
• Logs: Web server access logs showing POST requests to the plugin's AJAX endpoint from unauthenticated sessions, followed by GET requests to newly created PHP files in upload directories; WordPress debug logs showing unexpected file write operations.
• Process: Unusual child processes spawned by the web server (e.g., Apache/Nginx/PHP-FPM) such as bash, sh, curl, wget, or python; unexpected cron jobs or scheduled tasks added under the web server user account.

Update immediately to a version of the Pix for WooCommerce plugin newer than 1.5.0, which contains the patch addressing both the missing capability check and file type validation (WordPress Changeset). If an immediate update is not possible, disable or remove the plugin until patching can be performed. As additional hardening measures: implement a Web Application Firewall (WAF) with rules to block unauthenticated file upload requests to WordPress plugin endpoints; restrict PHP execution in the wp-content/uploads/ directory via server configuration (e.g., .htaccess or Nginx rules); and audit existing upload directories for unexpected PHP files (Wordfence, ENISA EUVD).

Wordfence, which assigned the CVE, published a weekly WordPress vulnerability report covering the March 9–15, 2026 period that included this flaw, drawing community attention (Wordfence Blog). Security researchers and automated accounts on Mastodon, Bluesky, and Infosec.exchange shared alerts shortly after disclosure. Morocco's national cybersecurity authority and Spain's CCN-CERT and INCIBE also issued advisories, reflecting broad international concern (Morocco World News). The rapid publication of multiple PoC repositories and a mass-scanner tool within days of disclosure indicates significant interest from the offensive security community.