CVE-2026-81534: Email Customizer WooCommerce RCE Vulnerability

CVE-2026-81534 Overview

The Email Customizer for WooCommerce (Pro) plugin for WordPress contains a remote code execution vulnerability in versions up to and including 3.9.5. The flaw resides in the send_test_mail() function, which lacks sufficient authorization checks and input sanitization. Authenticated users with subscriber-level access or higher can write user-controlled PHP code to executable files in the uploads directory. Successful exploitation gives attackers arbitrary PHP code execution on the WordPress server, resulting in full site compromise. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Subscriber-level attackers can write and execute arbitrary PHP code on the WordPress server, enabling full site takeover.

Affected Products

• Email Customizer for WooCommerce (Pro) plugin for WordPress
• All versions up to and including 3.9.5
• WordPress sites running WooCommerce with the vulnerable plugin

Discovery Timeline

• 2026-10-15 - CVE-2026-81534 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-81534

Vulnerability Analysis

The vulnerability stems from the send_test_mail() function in the Email Customizer for WooCommerce (Pro) plugin. This function fails to enforce proper capability checks before processing requests. It also fails to sanitize user-supplied input before writing it to disk. The combination allows low-privileged authenticated users to control the content and destination of files written to the WordPress uploads directory. Because files written to this location can be served and executed by the PHP interpreter, attackers achieve arbitrary code execution.

Root Cause

Two defects combine to produce the vulnerability. First, the authorization layer in send_test_mail() does not restrict access to administrators or users with the manage_options capability. Any authenticated user, including subscribers, can invoke the function. Second, the function does not sanitize or validate payload content before writing it to a file with a PHP extension in the uploads directory. The Wordfence research team documents the issue in the Wordfence Vulnerability Report.

Attack Vector

An attacker first registers or obtains a subscriber-level account on the target WordPress site. Open registration or WooCommerce customer accounts satisfy this requirement on many sites. The attacker then sends a crafted request to the AJAX endpoint invoking send_test_mail() with malicious PHP content and a target filename. The plugin writes the payload to the uploads directory. The attacker then requests the resulting file via HTTP, causing the webserver to execute the embedded PHP code with the privileges of the webserver user.

No verified exploit code is publicly available. Refer to the ThemeHigh Changelog Update for vendor-provided remediation details.

Detection Methods for CVE-2026-81534

Indicators of Compromise

• Unexpected .php files appearing in wp-content/uploads/ or plugin-specific subdirectories
• POST requests to admin-ajax.php referencing the send_test_mail action from non-administrator accounts
• Webserver access logs showing direct requests to PHP files inside the uploads directory
• Creation of new administrator accounts or modifications to WordPress options tables shortly after suspicious AJAX activity

Detection Strategies

• Monitor the WordPress uploads directory for file writes with executable extensions such as .php, .phtml, or .phar
• Correlate authenticated AJAX requests to send_test_mail with the capability level of the invoking user
• Deploy file integrity monitoring on wp-content/uploads/ and alert on any script-type file creation

Monitoring Recommendations

• Enable WordPress audit logging for plugin AJAX endpoints and user registration events
• Forward webserver and WordPress logs to a centralized SIEM for correlation across request patterns
• Alert on HTTP 200 responses to GET requests targeting PHP files under /wp-content/uploads/
• Review subscriber account creation trends for anomalous spikes preceding plugin exploitation attempts

How to Mitigate CVE-2026-81534

Immediate Actions Required

• Update the Email Customizer for WooCommerce (Pro) plugin to a version newer than 3.9.5 as published in the ThemeHigh Changelog Update
• Audit the wp-content/uploads/ directory for unexpected PHP files and remove any unauthorized scripts
• Review WordPress user accounts for recently created or escalated privileges
• Rotate all administrator and database credentials if evidence of exploitation is found

Patch Information

ThemeHigh has released a patched version of the Email Customizer for WooCommerce (Pro) plugin. Site administrators should consult the ThemeHigh Changelog Update for the specific fixed version and apply updates through the WordPress plugin manager or by replacing plugin files manually.

Workarounds

• Disable the Email Customizer for WooCommerce (Pro) plugin until the patch is applied
• Restrict WordPress user registration to trusted sources and disable open subscriber signup where feasible
• Configure the webserver to deny PHP execution within the wp-content/uploads/ directory
• Place the site behind a web application firewall with rules blocking requests to the vulnerable AJAX action

# Apache: deny PHP execution in the uploads directory
# Add to wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>

# Nginx: deny PHP execution in the uploads directory
# Add to the server block
location ~* /wp-content/uploads/.*\.ph(p|tml|ar)$ {
    deny all;
    return 403;
}