CVE-2026-103367: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in wpdesk ShopMagic – email automation for WordPress

CVE-2026-103367 is a Local File Inclusion vulnerability in the ShopMagic – email automation for WordPress plugin affecting versions up to 4.9.0. The vulnerability is due to improper control of the filename used in an include or require statement, specifically via the 'billing_address.first_name' parameter. This allows unauthenticated attackers to include and execute arbitrary PHP files on the server. The plugin's default "New Order email with social media profile links" recipe processes the {{ customer.first_name }} placeholder, enabling exploitation by submitting a guest checkout with a malicious payload in the billing first name field. This can lead to remote code execution, bypass of access controls, and exposure of sensitive data.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server hosting the vulnerable plugin. This can lead to full compromise of the affected system, including bypassing access controls and accessing sensitive information. The vulnerability has a high CVSS score of 8.1, reflecting its potential severity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or restrict the use of the vulnerable parameter or the affected recipe if possible. Monitor vendor channels for updates and apply patches promptly once released.