ShopMagic for WooCommerce EUVD-2026-100903

Exploitation requires a published ShopMagic recipe that processes the {{ customer.first_name }} placeholder; the plugin's built-in 'New Order email with social media profile links' recipe satisfies this out of the box, so default installations are vulnerable. The attacker needs no account, cookie, or nonce - only the ability to submit a WooCommerce guest checkout with a path payload in the billing first-name field. Achieving full remote code execution (versus bypassing access controls or reading sensitive files) additionally requires that an attacker-controllable .php file already exist on the server, which is the main limiting factor; installs that disabled or replaced the first-name-consuming recipe are not exploitable, which is why CVSS assigns AC:H.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, 8.1) describes an unauthenticated, network-reachable PHP Local File Inclusion (CWE-98) with full confidentiality, integrity, and availability impact, and the description confirms the default configuration is exploitable: the bundled 'New Order email with social media profile links' recipe processes the {{ customer.first_name }} placeholder, so a plain guest checkout with no account, cookie, or nonce triggers it. The AC:H rating is the one honest friction point - it reflects the dependency on a published recipe that consumes the first-name placeholder - but Wordfence's own analysis notes that dependency is satisfied out of the box, so for a large share of installs real-world complexity is closer to low. No EPSS score, no CISA KEV listing, and no POC flag were supplied, so there is no evidence of active exploitation or public exploit code yet; the exploitation signals are therefore all derived from the vulnerability's intrinsic properties (unauthenticated, default-exploitable, RCE-capable) rather than observed attacks. The combination of unauthenticated reach and code-execution potential on an internet-facing WooCommerce store makes this a priority to patch despite the absence of KEV/EPSS/POC data.

An unauthenticated attacker visits the WooCommerce store, begins a guest checkout, and submits a crafted path as the billing first name; when the order triggers the default ShopMagic email recipe that renders the {{ customer.first_name }} placeholder, the value is passed to the SimplePhpRenderer and an attacker-chosen .php file on the server is included and executed. Combined with any mechanism to place a .php file on disk (e.g. an upload feature), this yields arbitrary PHP code execution as the web server; no public exploit code was identified at time of analysis.