CVE-2026-103367

8.1High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-98

Impact

Unauthenticated attackers can achieve arbitrary PHP code execution or read sensitive files via guest checkout without any account or authentication. The attack works out of the box if recipes using the {{ customer.first_name }} placeholder, such as the default "New Order email with social media profile links", are active.

Root cause

The plugin unsafely passes the unvalidated 'billing_address.first_name' guest checkout field to a PHP template renderer, allowing local file inclusion of arbitrary .php files.

Affected systems

ShopMagic – email automation for WordPress versions up to and including 4.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade the ShopMagic plugin to version 4.9.1 or later. If patching immediately is not possible, disable the plugin or deactivate any published recipes processing the {{ customer.first_name }} placeholder, including the default "New Order email with social media profile links" recipe.

shell

$ wp plugin update shopmagic-for-woocommerce

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-103367