Email Customizer Pro EUVD-2026-101864

Exploitation requires an authenticated account with subscriber-level privileges or higher (CVSS PR:L), so the realistic exposure is highest on stores that allow open customer/subscriber self-registration - common for WooCommerce but not universal. The specific vulnerable code path is the plugin's send_test_mail() function, which lacks sufficient authorization checks and input sanitization and writes user-controlled PHP into executable files in the WordPress uploads directory; the server must therefore allow PHP execution from that uploads path (not hardened/blocked) for code execution to succeed. The plugin affected is specifically the Email Customizer for WooCommerce (Pro) by ThemeHigh at versions up to and including 3.9.5. The primary limiting factors are the need for a valid low-privilege account and any server-side restriction on executing PHP from uploads.

This is a genuine high-priority vulnerability, not an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity exploitation requiring only PR:L - and the description independently confirms this maps to subscriber-level accounts, the lowest meaningful authenticated tier on most WordPress/WooCommerce sites that allow customer registration. The signals are internally consistent: CVSS network/low-complexity aligns with the described send_test_mail() flaw writing user-controlled PHP to executable files in the uploads directory, yielding full RCE. The limiting factor is the authentication requirement (PR:L): an attacker needs a valid low-privilege account, so sites that permit open customer/subscriber registration (common for WooCommerce stores) are far more exposed than those that do not. Key data is MISSING and must be flagged: no EPSS score, no CISA KEV listing, and no POC/exploit availability were provided, so exploitation status is 'no public exploit identified at time of analysis' and real-world exploitation probability cannot be quantified from the input. The absence of KEV/EPSS does not lower the intrinsic severity - RCE on authenticated low-privilege access against an internet-facing e-commerce platform warrants prompt patching regardless of current exploitation telemetry.

An attacker registers or obtains a subscriber-level account on a WooCommerce store running the vulnerable plugin, then sends a crafted request to the send_test_mail() function containing malicious PHP, which is written to an executable file in the wp-content uploads directory. The attacker then requests that file over HTTP to execute arbitrary PHP and achieve full site compromise. No public POC or exploit code was identified in the provided intelligence.