PT-2025-46299 · WordPress · Email Customizer For Woocommerce

Khaled Alenazi · Published 2025-11-11 · Updated 2025-11-12 · CVE-2025-11237

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Make Email Customizer for WooCommerce WordPress plugin versions through 1.0.6

Description The software does not properly verify user permissions or validate input data in its AJAX operations. This allows any authenticated user, even those with limited privileges like a Subscriber, to modify arbitrary WordPress options. The affected AJAX actions lack sufficient authorization checks and input validation, enabling unauthorized option updates.

Recommendations Update Make Email Customizer for WooCommerce WordPress plugin to a version beyond 1.0.6.

Exploit

Fix

Related Identifiers

CVE-2025-11237

Affected Products

Email Customizer For Woocommerce

References · 7

• 🔥 https://wpscan.com/vulnerability/88b46752-051b-4468-9e2b-cc81a9ce1075 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11237 · Security Note
• https://twitter.com/VulmonFeeds/status/1988201389730807912 · Twitter Post
• https://t.me/cveNotify/142376 · Telegram Post
• https://t.me/CVEtracker/37002 · Telegram Post
• https://t.me/cveNotify/142614 · Telegram Post
• https://twitter.com/CVEnew/status/1988130557130383686 · Twitter Post