CVE-2026-103358 Overview
CVE-2026-103358 is a code injection vulnerability in the VillaTheme Email Template Customizer for WooCommerce WordPress plugin. The flaw affects all versions up to and including 1.3.4. It is classified under CWE-94: Improper Control of Generation of Code.
The vulnerability allows an unauthenticated remote attacker to inject content through the plugin's email template handling. The issue carries a network attack vector with no authentication or user interaction required, resulting in high confidentiality impact on the affected WooCommerce store.
Critical Impact
Unauthenticated attackers can inject code into email templates processed by the plugin, exposing sensitive store data on WooCommerce sites running vulnerable versions.
Affected Products
- VillaTheme Email Template Customizer for WooCommerce (email-template-customizer-for-woo)
- All versions from initial release through 1.3.4
- WordPress sites running WooCommerce with the vulnerable plugin installed
Discovery Timeline
- 2026-10-14 - CVE-2026-103358 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-103358
Vulnerability Analysis
The plugin extends WooCommerce by letting store owners customize transactional email templates. The flaw stems from improper control over code generation within template handling paths. Attacker-supplied input reaches a context where it is interpreted rather than treated as inert data.
Because the vulnerability is reachable over the network without authentication, an attacker only needs the ability to send HTTP requests to the target WordPress site. The outcome is injection of attacker-controlled content into server-processed templates, with high impact on confidentiality.
Root Cause
The plugin fails to properly sanitize or validate input before incorporating it into code or template generation routines, matching CWE-94. Any input that influences template construction can alter the semantics of the generated output rather than appear as literal text.
Attack Vector
An unauthenticated remote attacker crafts a request targeting the vulnerable template processing logic. The injected payload is processed by the plugin and interpreted at the server, enabling content injection and disclosure of information rendered through the email template pipeline. Full technical details are available in the Patchstack advisory.
No public proof-of-concept code is available at this time. Describing exploitation in detail without a verified PoC would be speculative.
Detection Methods for CVE-2026-103358
Indicators of Compromise
- Unexpected modifications to WooCommerce email template files or database options maintained by email-template-customizer-for-woo.
- Outbound HTTP requests from the WordPress host to unknown domains triggered during email generation.
- Unusual content, markup, or script fragments appearing in WooCommerce transactional emails sent to customers.
Detection Strategies
- Inventory WordPress installations and flag any site running email-template-customizer-for-woo at version 1.3.4 or earlier.
- Review web server access logs for anonymous POST or GET requests targeting plugin endpoints and admin-ajax handlers associated with the plugin.
- Correlate changes in plugin-managed options with HTTP request sources to identify unauthenticated template modifications.
Monitoring Recommendations
- Enable WordPress file integrity monitoring on wp-content/plugins/email-template-customizer-for-woo/ and template storage locations.
- Monitor the WooCommerce email send pipeline for anomalous template content prior to delivery.
- Alert on new or modified scheduled tasks and cron entries created after suspicious plugin requests.
How to Mitigate CVE-2026-103358
Immediate Actions Required
- Identify all WordPress sites running VillaTheme Email Template Customizer for WooCommerce at version 1.3.4 or earlier.
- Deactivate the plugin on affected sites until a patched version is installed and verified.
- Rotate any credentials, API keys, or tokens that may have been exposed through email template rendering.
- Review recent WooCommerce transactional emails for signs of tampering or data exfiltration.
Patch Information
At publication, the Patchstack advisory lists the vulnerability as affecting versions up to and including 1.3.4. Administrators should consult the Patchstack advisory and the plugin page on WordPress.org for the latest fixed release, and update immediately once a patched version is published by VillaTheme.
Workarounds
- Deactivate and remove email-template-customizer-for-woo until a fixed version is available.
- Place the WordPress site behind a Web Application Firewall and block anonymous requests to plugin endpoints.
- Restrict access to WordPress administrative paths via IP allowlisting where operationally feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.