CVE-2026-107630

Name of the Vulnerable Software and Affected Versions Email Templates Customizer and Designer for WordPress and WooCommerce versions prior to 1.5.15

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can enumerate WooCommerce order IDs using the preview order parameter to exfiltrate customer personally identifiable information (PII), including billing names, addresses, phone numbers, and email addresses. The process involves two unauthenticated requests: first, obtaining a reusable nonce from the 302 Location header returned by the admin init() handler, and second, sending that nonce with an arbitrary order ID to the preview endpoint.

Recommendations Update Email Templates Customizer and Designer for WordPress and WooCommerce to version 1.5.15 or later.