CVE-2026-103367

Deferred Deferred - Pending Action

Local File Inclusion in ShopMagic WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Wordfence

Description

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103367

EUVD

EUVD-2026-100903

Affected Vendors & Products

Vendor	Product	Version / Range
wpdesk	ShopMagic	– email automation for WordPress 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

The ShopMagic WordPress plugin up to version 4.9.0 has a Local File Inclusion vulnerability in the 'billing_address.first_name' parameter. Unauthenticated attackers can include and execute arbitrary PHP files on the server by exploiting this flaw. This allows them to run malicious PHP code, bypass access controls, steal sensitive data, or gain full control of the server.

Detection Guidance

Check for unauthorized PHP file inclusions by reviewing server access logs for suspicious requests to the billing_address.first_name parameter. Look for patterns like repeated attempts to include files with unusual paths or extensions.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your server without authentication. They could steal sensitive data, install malware, deface your website, or use your server for further attacks. If your site uses the default 'New Order email with social media profile links' recipe, it is exploitable by simply submitting a guest checkout with a malicious payload as the billing first name.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. A successful exploit may result in data breaches, leading to legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Update the ShopMagic plugin to the latest version immediately. If an update is not available, disable the plugin until a patch is released. Review and restrict file upload permissions on the server to prevent arbitrary PHP execution.

Hi! I’m here to help you understand CVE-2026-103367. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70