Stores running payever’s WooCommerce Gateway through version 4.8.0 should update to 4.9.0 or a newer patched release. Wordfence’s advisory describes an unauthenticated file-upload vulnerability leading to remote code execution.
Tracked as CVE-2026-93754, it has Wordfence’s CVSS 3.1 score of 9.8, Critical. The WordPress directory now names the plugin payever Checkout – Composable Payment Gateway.
Keep the attack-chain dependency in view
Wordfence describes three callbacks lacking authentication checks and an image-import routine that writes a remotely fetched file into public uploads before validating its type. An executable PHP file could consequently reach the server.
The full chain’s token-recovery stage depends on an outbound validateToken() request to Payever’s service. The advisory separately identifies an independently exploitable identity overwrite using hard-coded credentials. That dependency should not be presented as proof that the plugin is safe.
Wordfence dates public disclosure to November 6; the CVE record was published November 7. These records do not establish exploitation in the wild.
Update the plugin and verify the store
The developer’s 4.9.0 changelog in the official WordPress repository is part of the October 23 release changeset and lists capability and nonce checks for administrative actions, verified-image requirements for product imports, and hardened logging and token-based endpoints. The WordPress plugin directory also lists 4.9.0 as the current release. The fix therefore predates the November disclosure.
DaySec recommends checking the installed version after updating, then testing the store’s checkout and its configured payment and synchronisation workflows. Review unexpected plugin-configuration changes and unfamiliar executable files in uploads if there are signs of earlier interference.
A successful update confirms deployment of a fix; it does not demonstrate that an exposed store was never compromised. Preserve relevant logs and investigate suspicious findings before treating the incident as resolved.
