Authorization Bypass Vulnerability in Email Templates Customizer for WooCommerce by WordPress

CVE-2026-107630

What is CVE-2026-107630?

The Email Templates Customizer and Designer for WooCommerce plugin is susceptible to an authorization bypass vulnerability. This flaw allows unauthorized users to exploit the system by leveraging the preview_order parameter to enumerate WooCommerce order IDs. By doing so, attackers can access sensitive customer information such as billing names, addresses, phone numbers, and emails. The attack requires two simple requests: first, harvesting a nonce from the unguarded admin_init handler's response, and then using this nonce with a chosen order ID to gain full access to customer PII without needing any legitimate account credentials.

References