Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter
highThe Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in th...
- CVSS:
- 8.8 (Wordfence)
- Affected:
- up to 3.9.5
- Fixed in:
- 3.9.6
- Disclosed:
- Oct 14, 2026