The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
The ShopMagic email automation plugin for WordPress contains a critical Local File Inclusion (LFI) vulnerability affecting all versions through 4.9.0. The flaw exists in the 'billing_address.first_name' parameter, allowing unauthenticated attackers to include and execute arbitrary PHP files on vulnerable servers. This is particularly dangerous because it requires no authentication, meaning any internet user can exploit it. WordPress sites running affected versions of this popular email automation plugin face immediate risk of unauthorized code execution, data theft, and complete server compromise. The vulnerability is rated 8.1 (high severity) and could affect thousands of e-commerce platforms relying on ShopMagic for customer communications.
While CVE-2026-103367 currently shows zero matching Casky skills and no direct MITRE ATT&CK technique mapping, practitioners using Casky.ai can detect exploitation patterns by monitoring for suspicious file inclusion attempts and PHP execution anomalies. Attack chains targeting this vulnerability would typically involve Reconnaissance (T1592) to identify WordPress installations, followed by Exploitation attempts that manifest as unusual HTTP requests with path traversal patterns in the billing_address parameter. Practitioners should watch for indicators including: unexpected local file access in web logs, PHP execution from non-standard directories, parameter pollution attempts with directory traversal sequences (../, ..\), and sudden spikes in 404 errors mixed with successful requests. When Casky's extended reasoning analyzes request logs, it can correlate suspicious parameter values with backend file access patterns to surface LFI exploitation attempts that might otherwise blend into normal traffic noise.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-103367. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation