Improper control of code generation in the VillaTheme Email Template Customizer for WooCommerce plugin permits arbitrary PHP code to be executed when a template is processed. The flaw arises because user supplied template content is not properly sanitized before being evaluated as code, enabling malicious code that runs with the web server’s permissions and potentially compromising the entire WordPress installation.

It affects the VillaTheme Email Template Customizer for WooCommerce plugin for all releases up to and including version 1.3.4. Any WordPress site that has installed this plugin and uses the template editing feature is potentially vulnerable. Versions earlier than the first release are not affected because the plugin does not exist there.

The CVSS score of 7.5 indicates high severity. The EPSS score is 0.00322 (< 1%), indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, based on the plugin’s web interface that accepts template edits. An authenticated user or one with template edit privileges could trigger the injection, but the CVE description does not explicitly state authentication requirements, so this remains an inference.