Exploit for CVE-2026-3891

## https://sploitus.com/exploit?id=C1F0C6AE-3E9F-5D65-90F4-8A01538561C7
# CVE-2026-3891
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
# 💣 Pix for WooCommerce  If protocol is missing → script auto-adds `http://`

---

### 2️⃣ Add Your Shell

Put your shell file in same directory:

```
shell.php
```

---

### 3️⃣ Run Exploit

```bash
python3 CVE-2026-3891.py
```

---

### 4️⃣ Interactive Inputs

The script will ask:

- Targets file (default: `list.txt`)
- Threads (default: `8`)
- Shell filename (e.g. `shell.php`)

---

## ⚡ Exploitation Flow

1. 🎯 Target loaded  
2. 🔑 Nonce requested  
3. 📤 Shell upload  
4. 💥 File uploaded twice  
5. 🔗 Shell path generated automatically  

---

## 📂 Shell Location

```
/wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/.php
```

---

## 📤 Output

### ✔ Success

- Displays formatted result
- Shows:
  - Target
  - Shell path
  - Full URL

### ❌ Failure

```
FAIL http://target.com (reason)
```

---

### 📄 Saved Results

```
shells.txt
```

---

## 📊 Live Progress

```
Progress 5/20 OK:3 FAIL:2
```

---

## ⚠️ Disclaimer

This project is provided **for educational and authorized security testing only**.

- Do NOT use on systems without permission  
- Unauthorized access is illegal  
- The author is NOT responsible for misuse  

---

## 👤 Author

**Nxploited**

- 👨‍💻 Khaled Alenazi  
- 📬 Telegram: @Kxploit  
- 📢 Channel: https://t.me/KNxploited