EUVD-2026-96379
GHSA-22j3-c3px-m76x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WooCommerce thank-you endpoint
-
DeliverySubmit crafted injection payload
-
ExploitPlugin processes untrusted input
-
ExecutionInjected code/content executed or rendered
-
ImpactSensitive data exposure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target WordPress site to have the VillaTheme 'Thank You Page Customizer for WooCommerce' plugin installed and active at version 1.2.3 or earlier, alongside WooCommerce. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed, and it is exploitable against default configurations once the plugin is present. The principal limiting factor is the narrow deployment scope - only stores running this specific, relatively uncommon plugin are exposed; no fixed release is identified in the provided data, so verify an updated version with the vendor/Patchstack. |
| Impact | Signals are mixed and point to a moderate, not top-tier, priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which normally argues for urgency; however the impact metrics are confined to C:H with I:N/A:N, which is internally inconsistent with the CWE-94 'Code Injection' classification - genuine code injection would be expected to raise integrity and availability (I:H/A:H), not confidentiality alone. The underlying Patchstack reference titles this a 'content injection' issue, which aligns far better with the C-only impact than with the 'RCE' tag applied in the metadata. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation. Net: treat as a standard patch-cycle item for sites running this specific plugin rather than an emergency - the headline 7.5 is driven by the network/unauthenticated metrics, but the real-world impact and even the vulnerability class are uncertain and should be verified against the Patchstack advisory. EPSS/KEV/POC data are all MISSING, so exploitation likelihood cannot be quantified. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a WooCommerce store running the Thank You Page Customizer plugin (≤1.2.3), injecting attacker-controlled code or content that is processed/rendered by the plugin's thank-you page logic. No public exploit code was identified at the time of analysis, and per the CVSS vector the primary demonstrated effect is disclosure/confidentiality rather than confirmed arbitrary code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated code injection in the VillaTheme 'Thank You Page Customizer for WooCommerce' plugin, versions up to and including 1.2.3, lets a remote attacker who can reach a site running the plugin cause arbitrary code to be generated and executed, primarily threatening the integrity of the WordPress installation (CVSS 3.1 base 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N per independent assessment). Any store that has both WooCommerce and this specific plugin installed and active is exposed, requires no credentials or user interaction, and is exploitable against default configurations. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and no vendor-released fixed version was found in the available data, so the practical risk is bounded by the narrow deployment scope of this relatively uncommon plugin rather than by any mass-exploitation signal.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so the first step is to confirm current status directly with the vendor and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woo-thank-you-page-customizer/vulnerability/wordpress-thank-you-page-customizer-for-woocommerce-plugin-1-2-3-content-injection-vulnerability) and upgrade to the first version the vendor marks as fixed; do not assume 1.2.3 is the last affected release without that confirmation. Until a fix is published, the highest-confidence control is to deactivate and remove the plugin if its thank-you-page customization is not business-critical - the trade-off is loss of that storefront customization, but it eliminates the exposed code path entirely. If the plugin must remain active, apply a virtual patch at the edge: block or tightly filter requests to the plugin's AJAX/REST handlers and admin-ajax.php actions that carry the vulnerable parameters, accepting that a WAF only matches known request patterns and can be bypassed by novel variants. Harden the hosting layer by making WordPress plugin/core files non-writable by the web user and disabling PHP execution in uploads and other unwritable directories (side effect: legitimate plugin/theme updates must then be run manually or via a controlled deployment process). Restrict WordPress admin access by IP where feasible, monitor file integrity for unexpected PHP files and for new or modified admin users, and review logs for anomalous requests to the plugin's endpoints to determine whether the injection has already been leveraged.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-94, Improper Control of Generation of Code ('Code Injection'), which means the plugin takes attacker-influenced input and feeds it into a code-generation or code-execution sink rather than properly constraining it to data. In a WordPress/WooCommerce context this typically manifests as plugin-supplied AJAX (admin-ajax.php) or REST endpoints, template rendering, or shortcode/option handling that builds PHP or template code from request parameters without validation, escaping, or an allow-list, so crafted input crosses the boundary from data into executable logic. The CPE string cpe:2.3:a:villatheme:thank_you_page_customizer_for_woocommerce:*:*:*:*:*:*:*:* describes the whole product family with no version constraint, indicating that every released version through 1.2.3 is in scope; the plugin depends on WooCommerce and runs inside the WordPress application stack, so exploitation inherits the WordPress process context and file-system permissions. Note the reporting source (Patchstack) labels the issue 'content injection' in its advisory URL while the CVE record and CWE assign it to code injection (CWE-94); the independent assessment's integrity-only vector (I:H, C:N) aligns with an attacker being able to inject/generate code that alters site content or behavior rather than a direct, guaranteed exfiltration of secrets.
Know when Thank You Page Customizer For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network injection (AV:N/AC:L/PR:N/UI:N); as a content/code injection the primary effect is integrity (I:H), with C/A unconfirmed, diverging from the input's C:H-only profile.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.
Executive ViewAI
The VillaTheme 'Thank You Page Customizer for WooCommerce' plugin, versions up to and including 1.2.3, contains an unauthenticated code injection flaw that allows anyone with network access to a store running the plugin to generate and execute arbitrary code on the underlying WordPress installation. Any WooCommerce storefront with this plugin installed and active is exposed without credentials or user interaction, and a successful attack primarily threatens the integrity of the site - enabling tampering with content, checkout flows, or injected malicious code that could undermine customer trust and payment-path integrity. Leadership should care because there is no vendor-released patch, and while the plugin's narrow adoption limits mass-exploitation risk, the affected systems are customer-facing e-commerce properties where compromise carries direct revenue and brand consequences.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall the 'Thank You Page Customizer for WooCommerce' plugin (versions up to and including 1.2.3) on any site that does not require it; restrict network access to the affected storefronts and block direct requests to the plugin's files via WAF or web server rules; enforce IP allowlisting or authentication in front of administrative and plugin endpoints; and monitor file integrity and logs for unexpected code creation or execution until a fixed version is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB