https://feed.craftedsignal.io/products/email-templates-customizer-and-designer-for-wordpress-and-woocommerce-up-to-and-including-1.5.14/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 19:36:24 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-email-templates-customizer-auth-bypass/Fri, 30 Oct 2026 19:36:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-email-templates-customizer-auth-bypass/The Email Templates Customizer and Designer for WordPress and WooCommerce plugin is vulnerable to an authorization bypass allowing unauthenticated attackers to enumerate WooCommerce order IDs and exfiltrate customer PII.The Email Templates Customizer and Designer for WordPress and WooCommerce plugin (all versions up to, and including, 1.5.14) is vulnerable to an authorization bypass. The plugin fails to properly verify user authorization, allowing unauthenticated attackers to enumerate WooCommerce order IDs via the preview_order parameter and exfiltrate customer billing names, addresses, phone numbers, and email addresses. Exploitation involves harvesting a reusable nonce from the 302 Location header of an unguarded admin_init handler and using it to access the preview endpoint.

]]>highadvisory