CVE-2026-81534: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in ThemeHigh Email Customizer for WooCommerce (Pro)

CVE-2026-81534 is a remote code execution vulnerability in the Email Customizer for WooCommerce (Pro) plugin for WordPress, affecting versions up to and including 3.9.5. The vulnerability stems from improper neutralization of special elements in output used by a downstream component (CWE-74) within the send_test_mail() function. This allows authenticated attackers with subscriber-level privileges or higher to inject PHP code into executable files in the uploads directory, enabling arbitrary code execution and potentially full site compromise.

An attacker with subscriber-level or higher access can execute arbitrary PHP code on the affected server, resulting in complete control over the WordPress site. This includes the ability to modify site content, steal data, or deploy further malicious payloads. The vulnerability has a high CVSS score of 8.8, reflecting its critical impact on confidentiality, integrity, and availability.

No patch or official fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to the send_test_mail() function. Avoid using the vulnerable plugin version if possible.