Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-08
payever - WooCommerce Gateway - Security Vulnerability (CVE-2026-93754)
The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full…
PLUGIN
payever - WooCommerce Gateway
CVE-2026-93754
Risk Score
Threat Entry
Updated 2026-10-11
Payever - WooCommerce Gateway - Security Vulnerability (CVE-2026-42716)
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway
PLUGIN
Payever - WooCommerce Gateway
CVE-2026-42716
Risk Score