CVE-2026-81534

Name of the Vulnerable Software and Affected Versions Email Customizer for WooCommerce (Pro) versions prior to 3.9.6

Description Insufficient authorization and input sanitization in the send test mail() function allow authenticated attackers with subscriber-level access and above to write user-controlled PHP code to executable files within the uploads directory. This flaw enables the execution of arbitrary PHP code on the server, which can lead to a full site compromise.

Recommendations Update Email Customizer for WooCommerce (Pro) to version 3.9.6 or later. As a temporary workaround, restrict access to the send test mail() function to prevent unauthorized users from triggering the mail test feature.