Email Template Customizer CVE-2026-103358

The affected component is the VillaTheme 'Email Template Customizer for WooCommerce' plugin, versions up to and including 1.3.4, which necessarily requires a WordPress site running WooCommerce with this plugin installed and active. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no user interaction and no stated privilege requirement, but the exact vulnerable feature, endpoint, or template-processing setting is NOT described in the available data and could not be confirmed from the vendor advisory. LIMITING FACTORS: exposure is confined to sites running this specific plugin (not WooCommerce generally); the documented impact is confidentiality/content injection rather than code execution; and the PR:N (unauthenticated) assertion is unverified - this plugin class commonly gates such functionality behind authentication, so a privilege prerequisite cannot be ruled out.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a remotely reachable, low-complexity, unauthenticated issue - but its impact profile (C:H, I:N, A:N) is internally inconsistent with the CWE-94 'Code Injection' classification and the 'RCE' tag: genuine code execution would normally yield integrity and/or availability impact, not confidentiality-only. The Patchstack reference URL titles this a 'content injection vulnerability,' which aligns far better with the C:H/I:N/A:N vector than with 'RCE.' This signals the RCE tag likely overstates real impact. No EPSS score, no CISA KEV listing, and no public exploit (POC) were provided, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data. Net assessment: this reads as a real but moderate-priority WordPress plugin bug rather than an urgent RCE - the headline 'RCE' framing is not supported by the supplied CVSS impact metrics. Also note PR:N (unauthenticated) is asserted by the input vector but could not be independently verified against the vendor/Patchstack advisory, and WordPress plugin injection flaws of this class frequently require at least low-privileged authentication - verify with Patchstack before treating as fully unauthenticated.

A remote attacker reaches an exposed endpoint of the Email Template Customizer for WooCommerce plugin (version 1.3.4 or earlier) and submits crafted input that is improperly treated as code/markup, injecting attacker-controlled content into the rendered email template. Per the supplied vector this requires no user interaction and the dominant documented impact is disclosure of sensitive information (C:H), not full system takeover. No public proof-of-concept was provided in the intelligence set.