Description
The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.
Published: 2026-10-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The WordPress plugin Email Customizer for WooCommerce (Pro) contains a flaw in its send_test_mail() function. Insufficient authorization checks let any authenticated user with subscriber-level privileges inject PHP code, which is then written to executable files in the uploads directory. This allows an attacker to run arbitrary code on the web server, effectively compromising the entire site.

Affected Systems

Vulnerable installations of ThemeHigh Email Customizer for WooCommerce (Pro) version 3.9.5 or earlier, hosted on a WordPress site.

Risk and Exploitability

The flaw scores 8.8 on CVSS, indicating high severity, while the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog. Though exploitation requires valid credentials, the attacker can achieve full compromise through the web interface, making the risk high for any WordPress site that has not applied the patch.

Generated by OpenCVE AI on October 25, 2026 at 19:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the plugin to the latest version (3.9.6 or later) or remove it entirely.
  • Scan the wp-content/uploads directory for any recently created or altered PHP files and delete them.
  • Set the upload directory write permissions to readonly for web server processes to prevent future code injections.

Generated by OpenCVE AI on October 25, 2026 at 19:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.
Title Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter
Weaknesses CWE-74
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-15T16:43:40.115Z

Reserved: 2026-08-26T22:38:35.850Z

Link: CVE-2026-81534

cve-icon Vulnrichment

Updated: 2026-10-15T16:37:53.349Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T07:18:03.093

Modified: 2026-10-15T17:17:28.920

Link: CVE-2026-81534

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-25T19:45:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')