EUVD-2026-39748
GHSA-qqcv-c52c-7244
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-accessible WordPress endpoint, no special conditions; PR:L because subscriber account is required; no confidentiality impact per description.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.
AnalysisAI
Broken access control in Email Marketing for WooCommerce by Omnisend (versions up to and including 1.19.0) allows authenticated subscriber-level WordPress users to invoke privileged plugin functionality without proper authorization checks. Exploitation requires only a low-privilege WordPress account and no user interaction, enabling unauthorized modification of plugin state and potential availability disruption. No public exploit code or active exploitation has been identified at time of analysis, but the low barrier - subscriber-level access - elevates real-world concern on sites with open user registration.
Technical ContextAI
The vulnerability maps to CWE-862 (Missing Authorization), meaning the plugin fails to verify that the calling user possesses the required capability or role before executing sensitive operations. In the WordPress authorization model, the subscriber role is the lowest authenticated role, typically granted to any registered user. WooCommerce plugins commonly register custom REST API routes or AJAX handlers; when these handlers omit nonce verification or capability checks (e.g., current_user_can()), any authenticated subscriber can trigger them. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) confirms the flaw is network-reachable with no special attack complexity beyond holding a valid session cookie. The Patchstack advisory (referenced via NVD) identifies this as a classic subscriber-level access control failure within the Omnisend Connect WordPress plugin.
RemediationAI
Update the Omnisend WooCommerce plugin to a version beyond 1.19.0; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/omnisend-connect/vulnerability/wordpress-email-marketing-for-woocommerce-by-omnisend-plugin-1-19-0-broken-access-control-vulnerability should be consulted for the confirmed fixed release version, as no exact patched version number is available in the current source data. No vendor-released patch version has been independently confirmed from the provided references. As a compensating control while awaiting a patch, administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent untrusted parties from obtaining subscriber accounts, though this may impact legitimate storefront functionality. Alternatively, a WordPress WAF such as Patchstack or Wordfence can be configured to virtually patch the specific endpoint. Note that disabling registration may break WooCommerce customer account creation flows depending on site configuration.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today