Skip to content
Sign in Sign up
JA EN FR
SecPulse
A detailed explainer is available in Japanese. Read the Japanese explainer
Critical 9.8

payever決済プラグインに認証不要でコード実行の脆弱性

CVE-2026-93754 First seen on SecPulse

Summary

WordPressのWooCommerce用決済プラグインpayeverに、ログインなしでサーバー上のコードを実行されるおそれのある脆弱性が公表されました。ECサイトで使っていれば、版を確認して修正版の有無を調べ、なければ停止を検討してください。

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

WordPressのWooCommerce用決済プラグインpayeverに、ログインなしでサーバー上のコードを実行されるおそれのある脆弱性が公表されました。ECサイトで使っていれば、版を確認して修正版の有無を調べ、なければ停止を検討してください。

Affected packages

EcosystemPackageAffectedFixed
payever payever Checkout – Composable Payment Gateway
≤ 4.8.0
Not listed

This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.

Original description The description as published by the source.

The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.

Source: CVE.org (CVE Program・cvelistV5) NVD

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details