Security Alert Summary
The Email Customizer for WooCommerce (Pro) plugin contains a remote code execution vulnerability that allows authenticated users with subscriber-level access or higher to write user-controlled PHP to executable files in the uploads directory via the plugin’s test mail functionality. Successful exploitation can result in arbitrary PHP execution on the server.
CVE Details
- CVE ID:
CVE-2026-81534 - Affected component: Email Customizer for WooCommerce (Pro) plugin for WordPress
- Affected versions: Versions up to and including 3.9.5
- Published: October 15, 2026 7:18:03 AM
- Last modified: October 15, 2026 2:45:38 PM
- CVSS v3.1 base score: 8.8
- CVSS v3.1 severity: HIGH
- CVSS vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Authentication required: Yes (authenticated user)
- Privileges required: Low (subscriber-level access or higher)
- User interaction: None required
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness (CWE): CWE-74
Technical Details
The vulnerability is caused by insufficient authorization and input sanitization in the plugin’s send_test_mail() function. The function allows user-controlled data to be written into files within the uploads directory without proper validation, enabling attackers with authenticated accounts (subscriber-level and above) to write PHP code to executable files.
The ability to place executable PHP in a web-accessible location and trigger its execution results in remote code execution on the server. The description explicitly identifies the send_test_mail() function and the uploads directory as the vectors involved.
How This Could Impact Your Website
Consider a site with multiple users: the site owner, an internal editor, and an external contractor who contributes content. If any of these accounts has subscriber-level access or higher and the site uses an affected plugin version, an attacker who gains control of one of those accounts (or is already in control of a contractor account) could use the plugin’s test email feature to write and execute PHP on the server.
Practical consequences include exposure of site data, potential theft of internal user email addresses, and an increased risk of targeted phishing or social engineering campaigns against staff and contributors. While the vulnerability enables remote code execution, the exact outcome depends on the attacker and the server environment.
If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and subscriber accounts with elevated capabilities.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual file writes, unexpected uploads to the uploads directory, and unexpected PHP files.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
