Unauthenticated Arbitrary File Upload in Pix for WooCommerce

This repository is a small standalone Python exploit for CVE-2026-3891 targeting a WordPress WooCommerce-related plugin identified in code as payment-gateway-pix-for-woocommerce (described in the report banner as LKN Pix for WooCommerce). The repository contains one executable script (CVE-2026-3891.py), a minimal README, and a generic Python .gitignore. The exploit workflow is straightforward: it accepts either a single target or a text file of targets, normalizes each entry to a host, probes the host over HTTPS then HTTP, and then interacts with the WordPress AJAX endpoint /wp-admin/admin-ajax.php. It first requests a nonce using the action lkn_pix_for_woocommerce_generate_nonce with action_name=lkn_pix_for_woocommerce_c6_settings_nonce. If successful, it submits a second POST using action lkn_pix_for_woocommerce_c6_save_settings and uploads a file named woocommerce.php through the certificate_crt_path form field. The uploaded file is a PHP webshell: <?php if(isset($_REQUEST["cmd"])){system($_REQUEST["cmd"]);} ?>. The script expects the file to become accessible at /wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/woocommerce.php and reports that URL as the exploitation result. It also generates a local text report listing vulnerable and non-vulnerable targets, including the obtained nonce and a sample usage string such as curl "<shell_url>?cmd=whoami". Overall, this is a real exploit rather than a detector: its primary capability is unauthenticated or weakly protected arbitrary file upload leading to remote command execution via a planted PHP shell. It is operational but basic, with a hardcoded payload and no advanced post-exploitation features.

This repository is a small standalone Python exploit for CVE-2026-3891 targeting the WordPress plugin Pix for WooCommerce (linknacional) version 1.5.0 and earlier. The repo contains four files: a README describing the vulnerability and usage, a single Python exploit script, a minimal requirements.txt listing requests, and a .gitignore. The main exploit logic is in cve_2026_3891.py. It is not part of a larger exploitation framework. The script supports both single-target and multi-target operation, uses requests sessions with randomized User-Agent strings, disables TLS verification warnings, and includes threaded execution for mass exploitation. It first attempts to detect the plugin, including reading the plugin readme.txt to infer the installed version. It then abuses the unauthenticated WordPress AJAX endpoint /wp-admin/admin-ajax.php with action lkn_pix_for_woocommerce_generate_nonce to obtain a valid nonce, followed by action lkn_pix_for_woocommerce_c6_save_settings to upload a malicious PHP file through the certificate_crt_path parameter. The payload is a generated PHP web shell written into /wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/. The shell is token-gated using a required GET parameter t and exposes multiple post-exploitation capabilities: command execution via c, file upload via multipart field f, file deletion via del, and directory listing through a simple HTML interface. This makes the exploit more than a bare proof of concept; it is operational and intended to achieve persistent web shell access after successful upload. Operationally, the script appears designed to: detect vulnerable hosts, upload the shell, verify code execution, optionally clean up the shell, and optionally save successful shell URLs to an output file. Based on the README and visible code, this is a real exploit rather than a detector, and its primary attack vector is remote web exploitation against exposed WordPress instances.

This repository is a small, focused exploit PoC for CVE-2026-3891 affecting the WordPress Pix for WooCommerce plugin up to version 1.5.0. The repository contains two files: a single Python exploit script and a README. The Python script is the sole functional component and serves as the entry point. Exploit flow: the script prompts for a target WordPress base URL, normalizes it, and builds the AJAX endpoint at /wp-admin/admin-ajax.php. It first sends a POST request with action=lkn_pix_for_woocommerce_generate_nonce and action_name=lkn_pix_for_woocommerce_c6_settings_nonce to retrieve a nonce from the vulnerable plugin. It then uses that nonce in a second POST request to action=lkn_pix_for_woocommerce_c6_save_settings, uploading a file through the certificate_crt_path multipart field. The uploaded file is hardcoded as woocommerce.php and contains a minimal PHP webshell: it executes arbitrary OS commands passed via the cmd request parameter using system(). After upload, the script prints the expected URL of the webshell under /wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/woocommerce.php. Main capability: unauthenticated arbitrary file upload leading to remote code execution, assuming the uploaded PHP file is reachable and executable by the server. This is not merely a detector; it actively weaponizes the vulnerability by planting a command-execution webshell. The payload is basic and hardcoded, so the maturity is best classified as OPERATIONAL rather than WEAPONIZED. Repository structure is minimal: README.md documents the vulnerability, requirements, usage, and an example curl command invoking the uploaded shell with ?cmd=ls. No framework affiliation is evident; this is a standalone Python requests-based exploit.

This repository is a packaged exploit launcher for an alleged CVE-2026-3891 affecting the WordPress Pix for WooCommerce plugin (<= 1.5.0), described as an unauthenticated arbitrary file upload leading to RCE. The actual exploit logic is not visible in the provided files because the main script, CVE-2026-3891.py, is referenced repeatedly but absent from the snapshot and described as PyArmor-protected/encrypted. Based on the README and wrapper code, the tool is a GUI-driven Python exploit that accepts one or more target URLs or a .txt list, takes a local PHP shell file (default shell.php), runs concurrent exploitation threads, and writes successful shell locations to shells.txt. Repository structure is small and purpose-built: README.md documents usage and claims; run.sh is the primary launcher that prepares a Python virtual environment, installs dependencies, verifies the PyArmor runtime and main encrypted script, then dynamically writes and executes patch_runner.py; patch_runner.py and patch_test.py are not exploit logic themselves but translation shims that monkey-patch PyQt5 widgets to replace Indonesian UI strings with English while executing the encrypted main script via runpy.run_path("CVE-2026-3891.py"). The pyarmor_runtime_000000 package is only a loader for the protected code. Because the exploit body is unavailable, no vulnerable HTTP upload endpoint or hardcoded target path can be extracted from code. However, the repository clearly intends active exploitation rather than detection: it is designed to upload an operator-provided PHP web shell to vulnerable web targets and thereby obtain remote code execution. The absence of the main exploit file limits endpoint extraction to local file references and documentation URLs only.

Repository contains a Python exploit script, a README, a license, and a trivial PHP placeholder file. The main artifact is CVE-2026-3891.py, a multithreaded Python exploit targeting an unauthenticated arbitrary file upload in the WordPress Pix for WooCommerce plugin up to 1.5.0. The script accepts a target list and local PHP payload filename, normalizes target URLs, requests a nonce from the WordPress AJAX endpoint /wp-admin/admin-ajax.php using the action lkn_pix_for_woocommerce_generate_nonce, then uses that nonce to submit malicious plugin settings data to the vulnerable save action and upload an attacker-controlled PHP file. It predicts the final shell location under /wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/<shell>.php, prints successful results, and appends shell URLs to shells.txt. The exploit is operational rather than a simple PoC because it automates bulk exploitation, threading, nonce retrieval, upload, result formatting, and persistence of discovered shell URLs. README.md documents the vulnerability, usage flow, expected shell path, and required dependencies. Nx.php is not a functional exploit component; it appears to be a placeholder/test file.

This repository is a standalone Python proof-of-concept exploit for CVE-2026-3891, an unauthenticated arbitrary file upload vulnerability in the WordPress plugin payment-gateway-pix-for-woocommerce <= 1.5.0. The main exploit file is CVE-2026-3891.py. It uses requests to interact with the target WordPress AJAX endpoint /wp-admin/admin-ajax.php in two stages: first it requests a nonce using the unauthenticated action lkn_pix_for_woocommerce_generate_nonce, then it abuses lkn_pix_for_woocommerce_c6_save_settings to upload a PHP file disguised as a certificate upload field (certificate_crt_path). The script assumes the uploaded file lands at wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/shell.php, verifies that URL is reachable, and then executes arbitrary commands by sending parameter 0 to the uploaded shell. If no single command is provided, it opens a simple interactive shell loop. The exploit is operational rather than a mere detector because it includes a working payload and post-exploitation command execution. The embedded payload is a minimal PHP webshell using shell_exec on request parameter 0. A separate shell.php file in the repository contains a more robust webshell implementation that falls back across exec, shell_exec, system, passthru, and popen, though the Python exploit actually uploads its own inline shell content rather than this file. Repository structure is small and focused: one Python exploit, one PHP shell sample, dependency list, and a Docker lab. The docker directory provides a reproducible vulnerable environment using wordpress:6.8-php8.3-apache, mysql:8.0, WooCommerce 10.6.1, and payment-gateway-pix-for-woocommerce 1.5.0. entrypoint.sh prepares WordPress files and plugins, while setup.sh waits for MySQL, installs WordPress, activates WooCommerce and the vulnerable plugin, and exposes the lab on http://localhost:8080 with admin/admin credentials. This lab infrastructure indicates the repository is intended both for demonstration and exploit validation. The README appears partially inconsistent with the actual repository contents, describing Windows binaries and release artifacts that are not present; however, the code itself is coherent and clearly implements a real exploit path.

This repository is a standalone Python proof-of-concept exploit for CVE-2026-3891, an unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin (payment-gateway-pix-for-woocommerce) affecting versions up to 1.5.0. The main exploit file is CVE-2026-3891.py, which uses the requests library to interact with a target WordPress site. It first retrieves a nonce from /wp-admin/admin-ajax.php using the unauthenticated action lkn_pix_for_woocommerce_generate_nonce, then abuses the lkn_pix_for_woocommerce_c6_save_settings AJAX action to upload a PHP payload disguised as a certificate file. The exploit assumes the uploaded file lands in a predictable plugin path under wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/shell.php and then verifies accessibility over HTTP. The exploit’s primary capability is unauthenticated remote code execution by way of arbitrary file upload. After upload, it can execute a single attacker-supplied command via --command or enter an interactive loop that repeatedly sends commands to the webshell using HTTP GET parameter 0. The embedded payload is a minimal PHP shell that calls shell_exec on user input and returns the output. A separate shell.php file in the repository contains a more robust PHP shell implementation with multiple execution fallbacks, but the Python exploit actually uploads its own hardcoded one-line payload rather than this file. Repository structure is simple: one main Python exploit, one standalone PHP shell sample, dependency list in requirements.txt, and documentation files. There is also a Docker lab under docker/ containing a Dockerfile, docker-compose.yml, entrypoint.sh, and setup.sh. That lab provisions WordPress 6.8 with WooCommerce 10.6.1 and the vulnerable payment-gateway-pix-for-woocommerce 1.5.0 plugin, exposing the site on localhost:8080 for local testing. Overall, this is a real exploit repository rather than a detector: it automates exploitation end-to-end and provides a usable post-exploitation command interface.