{"vulnerability": "CVE-2026-3891", "sightings": [{"uuid": "a9b2e4e6-6522-4db4-b1d0-7e4a819515a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3891", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116221046168571316", "content": "", "creation_timestamp": "2026-03-13T09:00:34.937705Z"}, {"uuid": "c60a6021-8415-4da3-bd30-10cbd3d36afe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "seen", "source": "https://bsky.app/profile/secqube.com/post/3midhax55tf2g", "content": "", "creation_timestamp": "2026-03-31T05:33:16.227032Z"}, {"uuid": "48644387-3ff5-4ac3-ba4c-d25d170f8bcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/80516", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Mass-Scanner-CVE-2026-3891\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AnggaTechI\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-16 06:46:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-3891 Mass Scanning\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-16T07:00:04.000000Z"}, {"uuid": "e60822dd-0153-405d-b01a-90a3f2d408a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "seen", "source": "Telegram/yG0q3IpDztUHkWGWcBfSkFN1RblCcRFZP5pQldEwVfp_P8g", "content": "", "creation_timestamp": "2026-04-16T09:00:04.000000Z"}, {"uuid": "160a1be0-1de2-4d05-b18d-e974267b348a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "Telegram/_y8q98W_wDj_9gSWJ4DtvUkEf6LNgZKpsKCz5PdNB84x25Q", "content": "", "creation_timestamp": "2026-03-27T07:00:14.000000Z"}, {"uuid": "7fcb3f06-d7b8-4ec4-a592-f58c12cac6f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "Telegram/8LISbnUQFWA86ak3ubyaCZMxs8RQbiaZ8ONexaBDd7tfzQU", "content": "", "creation_timestamp": "2026-03-27T09:00:13.000000Z"}, {"uuid": "9cbca2fb-d0e2-469a-b7f8-1aa2b742ce49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/77374", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-3891\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vladimirmanylobed451\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-03-26 15:48:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDemonstrate an unauthenticated arbitrary file upload exploit in Pix for WooCommerce plugin versions up to 1.5.0 using exposed AJAX endpoints.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-03-26T16:00:05.000000Z"}, {"uuid": "dea3362d-7860-4457-8ba7-c51db8f130fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "seen", "source": "https://t.me/htfgtps/1093", "content": "CVE-2026-3891\nThe Pix for WooCommerce plugin for\nWordPress is vulnerable to arbitrary file\nuploads due to missing capability check\nand missing file type validation in the\n'Iknpixforwoocommercec6savesettings'\nfunction in all versions up to, and including,\n1.5.0. This makes it possible for\nunauthenticated attackers to upload\narbitrary files on the affected site's server\nwhich may make remote code execution\npossible.\nGitHub Link:\nhttps://github.com/AnggaTechl/Mass-Scanner-CVE-2026-3891", "creation_timestamp": "2026-05-09T14:47:51.000000Z"}, {"uuid": "fb9f6ce7-2687-4207-9fbd-3e0323cbfd33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "seen", "source": "https://t.me/GithubRedTeam/86650", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-3891-Linux\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a willygailo\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-31 09:49:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u26a1 This tool exploits CVE-2026-3891, a critical unauthenticated arbitrary file upload vulnerability found in the Pix for WooCommerce WordPress plugin (versions \u2264 1.5.0).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-31T10:00:04.000000Z"}, {"uuid": "242858e8-66b5-4ef5-b37d-933db7607b99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "seen", "source": "Telegram/iT1PJyzy2zf_oTXsFfTTGACzC4_vVMaCup1jJ7rbAepk_V4", "content": "", "creation_timestamp": "2026-05-31T15:00:06.000000Z"}, {"uuid": "38b7b5d7-947a-4897-ac03-773bf2dd5975", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "seen", "source": "Telegram/FGFKIrbz-0GFq9DZ4ZspWeXDVumjQMIc-VFuaWLOc6j6exk", "content": "", "creation_timestamp": "2026-05-31T11:00:10.000000Z"}, {"uuid": "598bdba9-946e-4d39-b164-8f50e06d0a8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93593", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a m4sh-wacker\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 19:06:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-3891 \u2014 Unauthenticated Arbitrary File Upload leading to Remote Code Execution in Pix for WooCommerce <= 1.5.0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-16T12:00:04.609074Z"}, {"uuid": "afd110c3-1a6c-4efb-b454-83ad6f581c38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93597", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-3891\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 19:36:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPix for WooCommerce Unauthenticated File Upload via certificate_crt_path Parameter | CVSS 9.8\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-16T12:00:05.006118Z"}, {"uuid": "718c8037-eca9-41e7-bdd8-53bfe98d0f1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "seen", "source": "Telegram/aLUBIgd1oXw2vuhuFf6alCjtWAQyS8DwghI3-yppd5LMZjw", "content": "", "creation_timestamp": "2026-07-16T19:00:04.412301Z"}, {"uuid": "5df10396-847f-4205-bfbd-8ad75027f5ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "seen", "source": "Telegram/HNPB5oa1yFVH3WekiUbQvvfAzLOwUwiNbJgQ6qW_ApvUQ1Y", "content": "", "creation_timestamp": "2026-07-16T19:00:05.244441Z"}, {"uuid": "04562b68-56c2-42d6-8179-03a9c6e3fee7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "seen", "source": "Telegram/fnq-HCCIjbhzeI4TC1ixQu82pH2CpmWc72Tdnvx0IlMjFVI", "content": "", "creation_timestamp": "2026-07-16T19:00:05.389280Z"}, {"uuid": "a6dd8973-32c6-42ad-a718-c3bfedb011d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/116931533266651908", "content": "\u203c\ufe0f CVE-2026-3891: A critical Unauthenticated Arbitrary File Upload vulnerability found in the Pix for WooCommerce WordPress plugin in versions up to and including 1.5.0.\nPoC: https://github.com/m4sh-wacker/CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit", "creation_timestamp": "2026-07-16T20:26:41.793062Z"}, {"uuid": "313a9bac-c427-4e0d-925a-2ef47f8b5e07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "Telegram/HNPB5oa1yFVH3WekiUbQvvfAzLOwUwiNbJgQ6qW_ApvUQ1Y", "content": "", "creation_timestamp": "2026-07-17T00:00:25.836539Z"}, {"uuid": "d8bcfd5a-cdda-4ff6-90d3-871ea9c2377b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "Telegram/fnq-HCCIjbhzeI4TC1ixQu82pH2CpmWc72Tdnvx0IlMjFVI", "content": "", "creation_timestamp": "2026-07-17T00:00:25.925292Z"}, {"uuid": "fda00aa4-0c8c-4493-bcd2-4d50020f5018", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "Telegram/aLUBIgd1oXw2vuhuFf6alCjtWAQyS8DwghI3-yppd5LMZjw", "content": "", "creation_timestamp": "2026-07-17T00:00:26.283841Z"}, {"uuid": "7ffe9162-33e7-4024-bfbf-fdbc4fbfe0e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93593", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a m4sh-wacker\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 19:06:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-3891 \u2014 Unauthenticated Arbitrary File Upload leading to Remote Code Execution in Pix for WooCommerce <= 1.5.0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-17T00:00:54.767695Z"}, {"uuid": "f6312a21-e7ae-4408-824f-f40474d917df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93597", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-3891\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 19:36:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPix for WooCommerce Unauthenticated File Upload via certificate_crt_path Parameter | CVSS 9.8\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-17T00:00:55.136443Z"}, {"uuid": "ae3da16b-2792-4b00-afe2-0af51de8563e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-3891.yaml", "content": "", "creation_timestamp": "2026-07-17T06:00:05.764846Z"}, {"uuid": "a8a9295d-66d8-4905-8f73-32e120d50d1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-3891.yaml", "content": "", "creation_timestamp": "2026-07-18T00:00:03.823209Z"}, {"uuid": "3321c143-1b89-4bc9-8516-177f87d82d56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-3891.yaml", "content": "", "creation_timestamp": "2026-07-19T00:00:04.379305Z"}, {"uuid": "aecead14-f042-48c4-8ec7-a1815ce2b8a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "Telegram/ERt8GGFekkTS_ieiBVGmLfcxPIuM72rFTxS1aPb6SalOFNw", "content": "", "creation_timestamp": "2026-07-20T18:00:04.885423Z"}, {"uuid": "3e809afd-4e64-4bce-9568-1731ae518297", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "Telegram/9tpNlnwjVZVYwuWejBnBA-eWQSN8G2bIqRE_fuaoLBUZlFA", "content": "", "creation_timestamp": "2026-07-20T18:00:05.065331Z"}, {"uuid": "9c324448-6929-4c68-a4e8-e18bd07681a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "Telegram/ERt8GGFekkTS_ieiBVGmLfcxPIuM72rFTxS1aPb6SalOFNw", "content": "", "creation_timestamp": "2026-07-21T00:00:31.617459Z"}, {"uuid": "025cd302-ebc1-4310-96a1-c9e29e53636a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3891", "type": "published-proof-of-concept", "source": "Telegram/9tpNlnwjVZVYwuWejBnBA-eWQSN8G2bIqRE_fuaoLBUZlFA", "content": "", "creation_timestamp": "2026-07-21T00:00:31.875335Z"}]}