CVE-2026-1925
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2Tags
Description
The EmailKit - Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'update_template_data' function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the title of any post on the site, including posts, pages, and custom post types.
Analysis
The EmailKit - Email Customizer for WooCommerce & WP plugin through version 1.6.2 fails to properly validate user permissions on the template update function, allowing any authenticated user with Subscriber-level access or higher to modify post titles across the WordPress site. This capability check bypass affects all post types including standard posts, pages, and custom post types, enabling unauthorized content manipulation by low-privileged attackers. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today