CVE-2026-103071: Improper Control of Generation of Code ('Code Injection') in VillaTheme Thank You Page Customizer for WooCommerce

The vulnerability identified as CVE-2026-103071 involves improper control of code generation in the VillaTheme Thank You Page Customizer for WooCommerce plugin, allowing code injection. This affects all versions from the initial release through 1.2.3. The CVSS 3.1 base score is 7.5, with an attack vector of network, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. The vulnerability could allow remote attackers to inject code, potentially leading to unauthorized disclosure of information.

An attacker can remotely exploit this vulnerability without authentication or user interaction to inject code, leading to a high confidentiality impact. There is no reported impact on integrity or availability. This could result in unauthorized access to sensitive information or data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin to mitigate potential exploitation.