Payever WooCommerce Gateway: critical flaw up to 4.8.0

What it is and who is affectedThe payever – WooCommerce Gateway plugin for WordPress carries a critical vulnerability tracked as CVE-2026-93754. Accor...

What it is and who is affected

The payever – WooCommerce Gateway plugin for WordPress carries a critical vulnerability tracked as CVE-2026-93754. According to the National Vulnerability Database (NVD) of NIST, the flaw is an arbitrary file upload issue (CWE-434) that can lead to remote code execution, and it affects various versions up to, and including, 4.8.0.

The technical root of the problem is a missing gate. Three WooCommerce-API callbacks — payever_set_sandbox_api_keys, payever_toggle_subscription and payever_synchronization_incoming — are registered without authentication, capability checks or nonce validation. On top of that, the upload_image() routine writes a remotely fetched file into the public uploads directory using an attacker-controlled basename()before it validates the file type. In practice, an unauthenticated attacker can drop an executable PHP file into a publicly reachable folder and run it.

The NVD entry also notes a second, independent weakness: an unauthenticated identity overwrite using hard-coded credentials (CWE-862 and CWE-798). The full token-recovery chain depends on the plugin's outbound validateToken() call to Payever's service, but that credential overwrite can be exploited on its own. The severity score is CVSS 3.1: 9.8, CRITICAL (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — network-reachable, no privileges required, no user interaction. The entry was published in the NVD on 7 November 2026.

Any online shop running WordPress with WooCommerce and this payment gateway plugin should treat itself as in scope, particularly small and mid-sized e-commerce businesses in Barcelona, Lleida, Tarragona and Girona that manage their own site or rely on a small IT team.

Why it matters, and what the KEV catalogue says

To be precise: CVE-2026-93754 does not currently appear in CISA's Known Exploited Vulnerabilities (KEV) catalogue. There is no public record that it is being exploited in real attacks, and we should not claim otherwise. That absence is not reassurance, however.

A 9.8 score with no authentication and no user interaction is the profile attackers scan for automatically. Public upload directories are indexed by mass scanners, and a plugin callback that answers unauthenticated requests is exactly the kind of surface that gets probed within hours of a disclosure. The window between publication and exploitation is short, and the potential impact — a PHP file executed on your server — means full control of the site, access to customer data and, under GDPR, a personal data breach with notification obligations.

What to do today

Check whether you use it. Look in the WordPress plugin list for payever – WooCommerce Gateway and confirm the installed version. Anything at or below 4.8.0 is affected.
Apply the fix from the vendor's advisory. The NVD entry does not state which version resolves the issue, so follow the official guidance published by the plugin maintainer and update to whatever release they indicate. Do not guess a version number.
Hunt for signs of intrusion. Review the public uploads directory for unexpected PHP files, and inspect logs for requests hitting the three vulnerable callbacks. Check for new or altered administrator accounts, which the credential overwrite path could enable.
Reduce what is exposed. Block direct execution of PHP inside upload folders, restrict access to WooCommerce API endpoints you do not need, and keep WordPress, WooCommerce and every plugin patched as a routine.
If in doubt, treat it as compromised. Take a clean backup, rotate credentials and payment gateway keys, and review the site before restoring service.

How a cybersecurity team like ALMC's can help

For a small business, the difficult part is rarely reading the advisory — it is knowing whether the flaw is present, whether it has already been used, and what to do with a site that may be quietly compromised. That is the work ALMC's cybersecurity service is built around: security audits and pentesting to find vulnerabilities before someone exploits them, hardening of servers and CMS installations, and continuous monitoring with incident response when something looks wrong.

For shops on WordPress, PrestaShop or Joomla, this also means disciplined maintenance and updating of the platform and its plugins, so that a critical advisory like this one becomes a routine patch rather than an emergency. And when a site has already been hacked, the job is to clean it, close the entry point and restore trust — including the GDPR side of the conversation. A payment gateway plugin sits directly on the money path of an online shop; it deserves the same attention as the checkout itself.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.