The WooMail - WooCommerce Email Customizer plugin for WordPress suffers from a missing capability check in the 'template_delete_saved' function, affecting all versions up to 3.0.34. This missing authorization allows authenticated users with low privileges (Subscriber and above) to inject SQL commands into a post deletion query, potentially altering data integrity. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, and impacting integrity only. No official patch or vendor advisory is currently available, and the plugin is not a cloud service.

The vulnerability enables authenticated users with Subscriber-level access or higher to inject SQL into a post deletion query, potentially modifying or corrupting data. There is no impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to post deletions. Avoid granting Subscriber or higher privileges to untrusted users.