CVE-2026-81534
Deferred Deferred - Pending Action

Remote Code Execution in Email Customizer for WooCommerce Pro

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Wordfence

Description
The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-81534
EUVD
EUVD-2026-101864

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ThemeHigh Email Customizer for WooCommerce (Pro) 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Remote Code Execution (RCE) flaw in the Email Customizer for WooCommerce (Pro) WordPress plugin. It exists in versions up to 3.9.5 due to insufficient authorization and input sanitization in the send_test_mail() function. Attackers with subscriber-level access or higher can exploit this to write user-controlled PHP code to executable files in the uploads directory, allowing them to run arbitrary code on the server and fully compromise the site.

Detection Guidance

Check for unauthorized PHP files in the WordPress uploads directory, particularly those with suspicious names or recent modification dates. Review server logs for unusual POST requests to /wp-admin/admin-ajax.php or /wp-json/wp/v2/test_mail endpoints. Inspect WordPress user roles for unauthorized subscriber-level or higher accounts.

Impact Analysis

If you use the vulnerable plugin version, an attacker could gain full control of your WordPress site. This includes accessing sensitive data, modifying or deleting content, installing malware, or using your site to attack others. The attack requires only subscriber-level access, making it easier for unauthorized users to exploit.

Compliance Impact

This vulnerability could lead to a data breach, exposing personal or sensitive data. For GDPR, this may result in fines for insufficient data protection. For HIPAA, it could violate patient privacy requirements. Compliance violations may occur if the breach affects regulated data, requiring notifications and potential penalties.

Mitigation Strategies

Update the Email Customizer for WooCommerce (Pro) plugin to version 3.9.6 or later immediately. Remove or restrict subscriber-level access if not required. Scan the server for malicious PHP files in the uploads directory and remove any unauthorized files. Review and harden WordPress user permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81534. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart