Authorization Flaw in Make Email Customizer for WooCommerce Plugin by WordPress
CVE-2025-11237
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 November 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-11237?
The Make Email Customizer for WooCommerce plugin prior to version 1.0.7 is susceptible to an authorization vulnerability. This flaw arises from the absence of proper authorization checks and insufficient option validation in its AJAX actions. As a result, authenticated users, including those with Subscriber roles, can exploit this weakness to modify arbitrary WordPress options, potentially compromising site integrity and user data.
Affected Version(s)
Make Email Customizer for WooCommerce 0 <= 1.0.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.