Remote Code Execution in Email Customizer for WooCommerce Plugin on WordPress

CVE-2026-81534

What is CVE-2026-81534?

The Email Customizer for WooCommerce (Pro) plugin is susceptible to a Remote Code Execution vulnerability, allowing attackers with subscriber-level access to trick the system into executing arbitrary PHP code. This flaw stems from inadequate authorization and a lack of proper input sanitization in the send_test_mail() function. It enables unauthorized modification of executable files in the uploads directory, which can lead to a complete compromise of the site. Users should ensure they are using the latest version of the plugin to mitigate these risks.

References