Email Templates Customizer and Designer for WordPress and WooCommerce: Authorization bypass (CVE-2026-107630)
The Email Templates Customizer and Designer for WordPress and WooCommerce plugin is vulnerable to an authorization bypass allowing unauthenticated attackers to enumerate WooCommerce order IDs and exfiltrate customer PII.
CVE search metadata
CVE search record: CVE-2026-107630. Severity: high. CVSS: 7.5. KEV: no. Product: Email Templates Customizer and Designer for WordPress and WooCommerce (up to and including 1.5.14). Brief: Email Templates Customizer and Designer for WordPress and WooCommerce: Authorization bypass (CVE-2026-107630). Brief link: https://feed.craftedsignal.io/briefs/2026-10-email-templates-customizer-auth-bypass/
Triage facts
Revision 1- Applicability
- Email Templates Customizer and Designer for WordPress and WooCommerce (up to and including 1.5.14)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 19:36 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Email Templates Customizer and Designer for WordPress and WooCommerce plugin (all versions up to, and including, 1.5.14) is vulnerable to an authorization bypass. The plugin fails to properly verify user authorization, allowing unauthenticated attackers to enumerate WooCommerce order IDs via the preview_order parameter and exfiltrate customer billing names, addresses, phone numbers, and email addresses. Exploitation involves harvesting a reusable nonce from the 302 Location header of an unguarded admin_init handler and using it to access the preview endpoint.