WooCommerce 3D Configurator Bug: Check and Fix Now

If your store runs the 3D Product configurator for WooCommerce plugin at version 2.16.2 or older, update to the newest version if the changelog confirms a security fix. If it does not, or you cannot tell, deactivate the plugin until you can. The flaw (CVE-2026-103889) is rated Critical and lets a stranger run code on your server without logging in.

This post is for owners of WooCommerce stores, and the agencies that look after them. You will learn what the bug is in plain English, how to check if you are affected, the exact steps to fix it, and how to look for signs that someone got in first.

What happened

On 2026-10-10, a vulnerability in the 3D Product configurator for WooCommerce plugin was published as CVE-2026-103889. A CVE is just a public ID number so everyone can talk about the same bug.

The record says the plugin is vulnerable to remote code execution in all versions up to, and including, 2.16.2. Remote code execution (RCE) means an attacker far away can make your web server run commands of their choosing. It is one of the most serious kinds of bug, because the server is the place that holds your site files, your database login and your customer records.

Two notes on the record:

• The National Vulnerability Database (NVD) lists its status as Deferred. That means NVD has not finished its own analysis, so details may be refined later.
• The NVD record does not list a fixed version number. So we will not guess one. The newest release may still be 2.16.2. Check for a version newer than 2.16.2 and read the plugin's changelog.

The key facts at a glance

The record's code references point to a plugin folder named expivi on the WordPress.org plugin repository, so that is likely this plugin's folder name. Confirm by checking the plugin's name and version in your dashboard.

How the bug works, in plain English

We will not publish attack steps. But you should understand the shape of the problem, because it explains why this is rated so high.

The plugin can build PDF files of a customer's product configuration. To do that, it uses a PDF library called Dompdf, which turns an HTML template into a PDF. According to the description, three things went wrong at once:

1. No login or nonce check. A nonce is a short-lived token WordPress uses to confirm a request came from a real, permitted action. In this plugin, the only check was wrapped inside a code comment, so it never ran. That means anyone on the internet could reach the code. The description says a single unauthenticated POST to any URL on the site is enough to hit it.
2. No cleaning of input. A form field called xpv_image was not sanitized (checked and stripped of dangerous content) before use.
3. Unsafe output with PHP turned on. That raw value was echoed into the PDF template, and the template was rendered with PHP execution enabled. So text sent by a stranger could be treated as code.

This is a classic injection problem, where untrusted input is mixed into something the server then runs. OWASP's Injection page explains the general idea. The NVD tags the weakness as CWE-434, a category usually associated with dangerous file handling. The exact mechanism is spelled out in the description above.

Why the score is 9.8

The CVSS score (a standard 0 to 10 severity rating) comes from the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Read in plain words, per the CVSS 3.1 specification:

• Network, low complexity: it can be attacked over the internet, with no special tricks.
• No privileges, no user interaction: the attacker needs no account, and nobody has to click anything.
• High impact on confidentiality, integrity and availability: data can be read, changed or destroyed, and the site can be knocked offline.

A 9.8 does not mean your store is hacked. It means that if it is exposed, the barrier to an attack is very low. The record we reviewed does not say whether this bug is being used in real attacks. Treat it as urgent anyway, since the details are public.

Step 1: Check if you are affected

In the dashboard:

1. Log in to WordPress.
2. Go to Plugins > Installed Plugins.
3. Find 3D Product configurator for WooCommerce. Note the version number under its name.
4. If it says 2.16.2 or lower, you are affected.

With WP-CLI (the command-line tool, if your host gives you SSH access):

wp plugin list --fields=name,title,status,version | grep -i -E '3d|expivi'

If nothing shows up, you do not have the plugin. Check every site on the account too, since agencies and hosts often run several.

Step 2: Back up, then update

A backup first takes two minutes and saves you if an update clashes with your theme.

1. Take a full backup of files and database (your host's backup tool or a backup plugin both work).
2. Go to Dashboard > Updates or Plugins > Installed Plugins and click Update now on the plugin, if a newer version than 2.16.2 is offered.
3. Or run: wp plugin update expivi (use the name shown in your wp plugin list output if it differs).
4. Re-check the version number. It should be higher than 2.16.2.
5. Place a test order with a configured product and confirm the PDF and cart still work.

Because no fixed version is named in the record, open the plugin's page on WordPress.org, read the Changelog tab, and look for a note about security or a fix for this issue. If you cannot find one, go to Step 3.

Step 3: If no safe update exists, switch the plugin off

If the update is not available, or breaks your store and you cannot fix it right away, deactivate the plugin:

wp plugin deactivate expivi

Or use Plugins > Installed Plugins > Deactivate. A deactivated plugin is generally not loaded by WordPress, so its handler should not run. Better still, delete it if you do not need it, so the vulnerable files are not sitting on disk.

Losing the 3D configurator for a day is a smaller cost than a compromised store. You can tell customers to order by email while you sort it out.

Step 4: Look for signs someone got in first

Updating or deactivating closes the door. It does not remove anyone who already walked through. Spend ten minutes on these checks:

• Check for unknown admin users. Run wp user list --role=administrator and look for names you do not recognize.
• Check core and plugin files. Run wp core verify-checksums and wp plugin verify-checksums --all. These compare your files against the official copies and flag changes.
• Look for recently changed PHP files. From your site root: find wp-content -name '*.php' -mtime -30. Odd files in uploads folders are a red flag, since that folder should hold images, not code.
• Review scheduled tasks. Run wp cron event list or install the WP Crontrol plugin (Tools > Cron Events) and look for entries you do not recognize.
• Watch for odd behavior. Spam pages, redirects, new users, unexpected emails sent from your domain, or a host warning.

Server logs usually do not record the body of a POST request, so you often cannot prove from logs alone that the bug was used. That is why file and user checks matter more. If anything looks wrong, follow our website hacked guide and consider rotating your passwords, database password and WordPress secret keys.

Extra layers that help (but do not replace the update)

• Turn on automatic updates for plugins you trust, under Plugins > Installed Plugins > Enable auto-updates.
• Remove plugins you no longer use. Every plugin is extra code that can have a bug.
• Use a web application firewall (a filter that blocks bad requests) if your host offers one. Ask whether a rule exists for this CVE, but never treat a firewall as a fix.
• Keep backups off the server, so a problem on the site cannot erase them.

If you want a quick outside look at your site's basics, try the free website security check. To understand your wider exposure, our guide on whether your website is hackable walks through the common weak spots.

Why plugin bugs like this keep happening

WordPress itself is reviewed heavily. Plugins are written by many different teams, with very different review habits. A bug like this one, where a safety check was accidentally left inside a comment, is easy to miss. A commented-out check is easy to miss in a code review, which is one reason a person testing your site matters.

See manual vs automated penetration testing for the differences.

Key takeaways

• CVE-2026-103889 affects the 3D Product configurator for WooCommerce plugin in all versions up to and including 2.16.2, and is rated Critical (CVSS 9.8).
• An attacker needs no account to reach the vulnerable code, so do not wait for a convenient moment.
• Back up, then update to a version newer than 2.16.2 if one exists and its changelog confirms a security fix. If it does not, or you cannot tell, deactivate or delete the plugin.
• Afterward, check for unknown admin users, modified files, odd PHP files in uploads and unfamiliar scheduled tasks.
• Read the original record at the NVD page for CVE-2026-103889, as details may change while its status is Deferred.

What to do next

This bug is a good reminder that a store can look fine while one plugin leaves a door open. If you want a human to go through your whole site, our Circuit audit is $49 one-time: a real engineer tests your site by hand and gives you a written report with severity, evidence and exact fixes. It is a focused small-site audit, not a multi-week enterprise pentest or a compliance certificate. If you would rather have the serious issues fixed for you, the pricing page explains the Signal plan.