Vulnerability · Published Nov 7, 2026 · Assigned by Wordfence

CVE-2026-93754payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

Critical 9.8

In plain English

A critical-severity unrestricted file upload in payever Checkout – Composable Payment Gateway from payever. There are no confirmed reports of exploitation so far.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)–no EPSS score yet

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.

Affected products (as reported)

Vendor	Product	Versions
payever	payever Checkout – Composable Payment Gateway	0 – through 4.8.0

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References