Email Templates Customizer and Designer for WordPress and WooCommerce CVE-2026-107630

Exploitation requires the affected plugin (Email Templates Customizer and Designer for WordPress and WooCommerce, ≤1.5.14) installed and active alongside WooCommerce with existing customer orders to disclose. The specific trigger is the plugin's WooCommerce preview handler: an unauthenticated request to the unguarded admin_init handler returns a reusable nonce in the 302 Location header, and that nonce plus an arbitrary order ID passed to the preview_order parameter returns the order's billing data. No authentication, credentials, user interaction, or non-default configuration is needed - exploitation works against default installations that have WooCommerce orders. The practical limiters are therefore only the presence of this plugin + WooCommerce and the existence of order records to enumerate; value scales with the number of stored orders.

This is a genuine, well-substantiated priority despite a 'medium' CVSS of 7.5. The CVSS vector (AV:N/AC:L/PR:N/UI:N) is internally consistent with the Wordfence description: fully remote, low-complexity, no privileges, and no user interaction, confirming trivial unauthenticated reachability. Confidentiality impact is C:H while I:N/A:N correctly reflects a pure data-disclosure (CWE-862 missing authorization) flaw with no write or availability effect - the 7.5 is capped by the single-impact dimension, not by any difficulty of exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), and the vulnerability is NOT in CISA KEV, so exploitation status is 'no public exploit identified at time of analysis'; the references are the Wordfence advisory and WordPress trac source lines, not a weaponized PoC. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. The signals do not conflict: a mechanically simple, pre-authentication mass-PII exfiltration against a WordPress/WooCommerce e-commerce plugin should be treated as a real, time-sensitive patching priority, with the main real-world limiter being the plugin's deployment footprint rather than any exploitation barrier.

An unauthenticated attacker sends a first request to the unguarded admin_init handler and captures a reusable nonce leaked in the 302 Location header, then issues a second request supplying that nonce and an arbitrary order ID to the preview_order endpoint. By iterating order IDs they enumerate every WooCommerce order and harvest each customer's billing name, address, phone number, and email. No public weaponized exploit is identified at time of analysis, but the Wordfence advisory and trac source references describe the full two-request technique in detail.