Code Injection Vulnerability in VillaTheme WooCommerce Customization Plugin
CVE-2026-103071

7.5HIGH

Key Information:

Vendor

WordPress
Status
Thank You Page Customizer For WooCommerce
Vendor
CVE Published:
10 October 2026

What is CVE-2026-103071?

The VillaTheme Thank You Page Customizer for WooCommerce plugin is affected by an improper control of code generation, allowing an attacker to perform code injection. This vulnerability could enable unauthorized access to sensitive data or system compromise. Users of versions up to 1.2.3 are particularly at risk, as the flaw facilitates malicious input through the plugin, emphasizing the need for immediate attention to upgrade to a secure version.

Affected Version(s)

Thank You Page Customizer for WooCommerce 0 <= 1.2.3

References

https://patchstack.com/database/wordpress/plugin/woo-than...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

cazy | Patchstack Bug Bounty Program
.