Expivi WooCommerce plugin has unauthenticated RCE with CVSS 9.8

A critical vulnerability, CVE-2026-103889 (CVSS 9.8), was found in the Expivi 3D Product Configurator plugin for WooCommerce up to version 2.16.2. The handler's only nonce and authentication check was commented out, and the unescaped xpv_image parameter reached a Dompdf template with isPhpEnabled, allowing PHP execution without login. It is fixed in 2.16.3.

• CVE-2026-103889: CVSS 9.8, all plugin versions up to 2.16.2 affected
• The only nonce and auth check was entirely wrapped in a block comment
• Dompdf with isPhpEnabled executed PHP injected via xpv_image
• Fixed in version 2.16.3; reported by Osman Hussein via Wordfence