CVE-2026-103367: ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billingaddress.firstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.firstname }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to unauthenticated exploitation?
Sites running ShopMagic 4.9.0 or earlier are exposed when they have a published recipe that processes the {{ customer.first_name }} placeholder. The built-in “New Order email with social media profile links” recipe meets this condition out of the box.
What does an attacker need to exploit this issue?
No account, cookie, or nonce is required. An attacker can submit a guest checkout and supply the payload as the billing first name.
Is a default setup affected?
Yes. The built-in “New Order email with social media profile links” recipe makes the default configuration exploitable if it is published.
What is the likely impact after successful exploitation?
An attacker can include and execute arbitrary PHP files present on the server. This may allow access-control bypass, sensitive-data exposure, or code execution where PHP files can be uploaded and then included.