CVE-2026-57632
Deferred Deferred - Pending Action
Subscriber Broken Access Control in Email Marketing for WooCommerce

Publication date: 2026-06-26

Last updated on: 2026-06-26

Assigner: Patchstack

Description
Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-26
Last Modified
2026-06-26
Generated
2026-06-26
AI Q&A
2026-06-26
EPSS Evaluated
N/A
NVD
CVE-2026-57632
EUVD
EUVD-2026-39748
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
omnisend email_marketing_for_woocommerce to 1.19.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-57632 is a Broken Access Control vulnerability in the WordPress plugin "Email Marketing for WooCommerce by Omnisend" versions 1.19.0 and below.

Broken Access Control means that the plugin lacks proper authorization checks, allowing unprivileged users to perform actions that should require higher privileges.

This vulnerability allows attackers to bypass restrictions and potentially manipulate or access features they should not have access to.

Impact Analysis

Exploiting this vulnerability could allow attackers to perform unauthorized actions within the affected plugin on your website.

Since the plugin is used for email marketing in WooCommerce, attackers might manipulate marketing data or disrupt email campaigns.

The vulnerability has a moderate severity with a CVSS score of 5.4, indicating a noticeable impact but not critical.

Thousands of websites could be targeted, so it is important to update the plugin to version 1.19.1 or later to mitigate the risk.

Mitigation Strategies

To mitigate the CVE-2026-57632 vulnerability in the Email Marketing for WooCommerce by Omnisend plugin, you should immediately update the plugin to version 1.19.1 or later.

If you are using Patchstack, you can enable auto-updates for vulnerable plugins to ensure timely patching.

Alternatively, seek assistance from your hosting provider or a developer to apply the necessary updates or mitigations.

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-57632 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57632. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart