Local File Inclusion Vulnerability in ShopMagic Plugin for WordPress

CVE-2026-103367

What is CVE-2026-103367?

The ShopMagic plugin for WordPress is susceptible to Local File Inclusion (LFI) in all versions up to and including 4.9.0 through the 'billing_address.first_name' parameter. This vulnerability allows unauthenticated attackers to include arbitrary .php files on the server, facilitating the execution of malicious PHP code. By leveraging a crafted input in a guest checkout, attackers can exploit the default configuration, which processes the {{ customer.first_name }} placeholder in the built-in 'New Order email with social media profile links' recipe. As a result, sensitive information can be compromised, and unauthorized access can be achieved without any authentication.

References