Shopmagic For Woocommerce Vulnerabilities

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.1. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

(Wordfence)

Affected:

up to 4.9.1

Fixed in:

4.9.2

Disclosed:

Oct 22, 2026

CVE-2026-114195 on NVD →

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server,...

CVSS:

8.1

(Wordfence)

Affected:

up to 4.9.0

Fixed in:

4.9.1

Disclosed:

Oct 13, 2026

CVE-2026-103367 on NVD →

The ShopMagic – email automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.7.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

(Wordfence)

Affected:

up to 4.7.2

Fixed in:

4.7.3

Disclosed:

Jan 7, 2026

CVE-2025-69093 on NVD →

The Free Follow-Up Emails & Marketing Automation for WooCommerce – ShopMagic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.6. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

7.5

(Wordfence)

Affected:

up to 4.5.6

Fixed in:

4.5.7

Disclosed:

Oct 15, 2025

CVE-2025-59578 on NVD →