CVE-2026-81534: Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter
The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the sendtestmail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. No administrator privileges are required.
What access does an attacker need to achieve code execution?
The attacker needs a valid WordPress account and the ability to reach the vulnerable test-email functionality. They can supply PHP code through the template parameter, which is written to an executable file in the uploads directory.
What is the likely impact of successful exploitation?
Successful exploitation allows arbitrary PHP code execution on the server. This can lead to full compromise of the affected WordPress site.
Which plugin versions are affected?
Email Customizer for WooCommerce (Pro) versions up to and including 3.9.5 are affected.