AI analysis
Claude Opus · 8 Nov 2026, 10:21 CET
payever WooCommerce Gateway plugin allows unauthenticated remote code execution
The payever WooCommerce Gateway plugin for WordPress, in versions up to and including 4.8.0, lets unauthenticated attackers upload executable PHP files and run code on the server. Administrators should update or remove the plugin immediately.
In plain terms
The payever WooCommerce Gateway is a WordPress plugin that connects online stores to the payever payment service. Several of its web callbacks accept requests without checking who is asking, and one of them saves a file fetched from a remote location into a public folder before checking whether the file is safe. This means an attacker who has not logged in can place a malicious PHP program on the site and have the server execute it.
Anyone running a WooCommerce store with this plugin should care. Successful exploitation effectively gives an outsider control over the website, which can lead to theft of customer and order data, defacement, or the site being used to attack others.