CVE-2026-103358: Improper Control of Generation of Code ('Code Injection') in VillaTheme Email Template Customizer for WooCommerce

The vulnerability identified as CVE-2026-103358 in the VillaTheme Email Template Customizer for WooCommerce plugin is an improper control of code generation issue, commonly known as code injection. It affects all versions from the initial release up to version 1.3.4 inclusive. The CVSS 3.1 base score is 7.5, indicating high severity, with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no impact on integrity or availability (I:N, A:N). This vulnerability could allow an unauthenticated attacker to inject code remotely.

An attacker can exploit this vulnerability remotely without authentication or user interaction to inject code, potentially leading to unauthorized disclosure of sensitive information. The impact is limited to confidentiality, with no direct impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor VillaTheme's official channels for updates and apply patches once available. Until then, consider restricting access to the plugin's functionalities or disabling it if feasible.