The EmailKit – Email Customizer for WooCommerce & WP plugin contains a missing capability check in the update_template_data function, allowing authenticated users with Subscriber or higher access to change the title of any post on the site. This flaw permits arbitrary alteration of content titles, undermining the integrity of posts, pages, and custom post types. The vulnerability is classified as CWE-862, representing a failure to fully authorize data modification actions.

The affected product is the EmailKit – Email Customizer for WooCommerce & WP plugin distributed by roxnor, impacting all WordPress installations that use this plugin up to and including version 1.6.2. WordPress sites employing WooCommerce or similar custom post type setups are within scope.

With a CVSS score of 4.3 and an EPSS score of less than 1%, the technical severity is moderate to low and the likelihood of exploitation is low. The flaw is not listed in the CISA KEV catalog. Attackers must be able to log in to the site with at least Subscriber privileges; once authenticated, they can invoke the vulnerable AJAX endpoint to modify post titles. No public exploit code is known, and the impact is confined to content integrity rather than full compromise.