CVE-2026-107630

The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate WooCommerce order IDs via the preview_order parameter and exfiltrate every customer's billing name, address, phone number, and email address. The exploit requires two unauthenticated requests: the first harvests a reusable nonce from the 302 Location header returned by the unguarded admin_init handler, and the second supplies that nonce alongside an arbitrary order ID to the preview endpoint, making full customer PII disclosure trivially achievable without any account or credentials.

• CWE-862

• https://plugins.trac.wordpress.org/browser/email-templates/tags/1.5.14/admin/class-mailtpl-admin.php#L54
• https://plugins.trac.wordpress.org/browser/email-templates/tags/1.5.14/includes/woocommerce-customizer/class-mailtpl-woomail-preview.php#L236
• https://plugins.trac.wordpress.org/browser/email-templates/tags/1.5.14/includes/woocommerce-customizer/class-mailtpl-woomail-preview.php#L293
• https://plugins.trac.wordpress.org/browser/email-templates/tags/1.5.14/includes/woocommerce-customizer/class-mailtpl-woomail-preview.php#L873
• https://plugins.trac.wordpress.org/changeset/3770280/email-templates/trunk/includes/woocommerce-customizer/class-mailtpl-woomail-preview.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/52eaab58-1e94-4f71-9896-dc2154b00e8e?source=cve

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107622The BuddyForms plugin for WordPress is vulnerable to Privile…9.8
• CVE-2026-107623A flaw was found in the OIDC Dynamic Client Registration (DC…4.3
• CVE-2026-107625The Ultimate Member – User Profile, Registration, Login, Mem…6.4
• CVE-2026-107627The Greenshift – animation and page builder blocks plugin fo…5.4
• CVE-2026-107629The Greenshift – animation and page builder blocks plugin fo…5.4
• CVE-2026-10763PROMOD V is using insecure HTTP communication instead of HTT…7
• CVE-2026-107631The Record of Consent Extension for Complianz plugin for Wor…7.2
• CVE-2026-107634Dislocker through 0.7.3 contains a heap out-of-bounds read v…6.1
• CVE-2026-107635Dislocker through 0.7.3 contains an integer underflow vulner…6.1
• CVE-2026-107636pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a …6.5
• CVE-2026-107637pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an…4.3
• CVE-2026-107638pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an…6.8