{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/email-templates-customizer-and-designer-for-wordpress-and-woocommerce-up-to-and-including-1.5.14/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-107630"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Email Templates Customizer and Designer for WordPress and WooCommerce (up to and including 1.5.14)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Email Templates Customizer and Designer for WordPress and WooCommerce plugin (all versions up to, and including, 1.5.14) is vulnerable to an authorization bypass. The plugin fails to properly verify user authorization, allowing unauthenticated attackers to enumerate WooCommerce order IDs via the \u003ccode\u003epreview_order\u003c/code\u003e parameter and exfiltrate customer billing names, addresses, phone numbers, and email addresses. Exploitation involves harvesting a reusable nonce from the 302 Location header of an unguarded \u003ccode\u003eadmin_init\u003c/code\u003e handler and using it to access the preview endpoint.\u003c/p\u003e\n","date_modified":"2026-10-30T19:36:24Z","date_published":"2026-10-30T19:36:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-email-templates-customizer-auth-bypass/","summary":"The Email Templates Customizer and Designer for WordPress and WooCommerce plugin is vulnerable to an authorization bypass allowing unauthenticated attackers to enumerate WooCommerce order IDs and exfiltrate customer PII.","title":"Email Templates Customizer and Designer for WordPress and WooCommerce: Authorization bypass (CVE-2026-107630)","url":"https://feed.craftedsignal.io/briefs/2026-10-email-templates-customizer-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Email Templates Customizer and Designer for WordPress and WooCommerce (Up to and Including 1.5.14)","version":"https://jsonfeed.org/version/1.1"}