WooCommerce Email Customizer Plugin Remote Code Execution

The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Email Customizer for WooCommerce (Pro) plugin contains a critical remote code execution vulnerability in its send_test_mail() function that allows attackers to write and execute arbitrary PHP code on WordPress servers. By exploiting insufficient input sanitization and authorization checks, authenticated users with subscriber-level privileges can upload malicious PHP files to the wp-content/uploads directory, achieving complete server compromise. This vulnerability affects all versions up to 3.9.5 and represents a significant risk for any WordPress installation using this plugin, as subscriber accounts are commonly created for legitimate users and are frequently targeted or compromised through credential stuffing and phishing campaigns.

Casky's 323 matched skills detect this attack pattern across two critical MITRE ATT&CK phases: TA0001 (Initial Access) and TA0043 (Persistence). The platform's Claude-powered analysis identifies the telltale indicators: suspicious POST requests to send_test_mail() with embedded PHP payloads, file write operations to wp-content/uploads with executable extensions, and subsequent HTTP requests attempting to trigger the uploaded files. Practitioners using Casky would observe detection findings highlighting CWE-74 (Improper Neutralization of Special Elements in Output) patterns, flagged authorization bypass attempts from low-privilege accounts, and process execution chains spawning from the web server user. The extended reasoning capability correlates these signals across web logs, file integrity monitoring, and process telemetry to distinguish legitimate plugin activity from exploitation attempts, enabling rapid incident response before attackers establish persistent backdoors.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-81534.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-81534

Casky has 323 skills that investigate the attack patterns behind CVE-2026-81534. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn