The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 11 Nov 2025 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options. | |
| Title | Make Email Customizer for WooCommerce <= 1.0.6 - Subscriber+ Arbitrary Options Update | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2025-11-11T06:00:04.427Z
Reserved: 2025-10-02T04:56:22.528Z
Link: CVE-2025-11237
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-11-11T06:15:34.690
Modified: 2025-11-11T06:15:34.690
Link: CVE-2025-11237
Redhat
No data.
OpenCVE Enrichment
No data.