Remote Code Execution in Email Customizer for WooCommerce

The Email Customizer for WooCommerce (Pro) plugin for WordPress contains a critical Remote Code Execution vulnerability (CVE-2026-81534) affecting versions up to and including 3.9.5. The vulnerability stems from insufficient authorization and input sanitization within the send_test_mail() function. An authenticated attacker with subscriber-level access or higher can leverage this function to inject arbitrary PHP code, which is then written to executable files within the WordPress uploads directory. Successful exploitation allows for full site compromise, enabling attackers to gain control over the web server environment. This vulnerability is significant due to the low barrier to entry for authenticated subscribers and the potential for complete application takeover.

Impact

Successful exploitation results in full site compromise for WordPress installations using the vulnerable plugin. This allows unauthorized actors to execute arbitrary code, modify application files, access sensitive database information, and potentially pivot to the underlying server infrastructure. All organizations utilizing Email Customizer for WooCommerce (Pro) version 3.9.5 or earlier are at risk.

Recommendation

• Update the Email Customizer for WooCommerce (Pro) plugin to the latest version immediately to remediate CVE-2026-81534.
• Review the WordPress uploads directory for anomalous PHP files or unauthorized modifications.
• Audit subscriber-level account activity for unexpected interactions with the Email Customizer plugin functionality.