Email Templates Customizer WordPress plugin authorization bypass listed as EUVD-2026-114218
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- saadiqbal
- Product
- Email Templates Customizer and Designer for WordPress and WooCommerce
- First seen
Summary
The EUVD listing (CVSS v3.1 score 7.5) describes an authorization bypass in the Email Templates Customizer and Designer plugin for WordPress and WooCommerce, affecting all versions up to and including 1.5.14. The listing does not name a CVE ID and the item does not indicate that a fix is available.
If you use saadiqbal
Check whether the plugin is installed and confirm its version
Update to a patched version from the plugin author once available
Review user roles and recent email template changes for unauthorized edits
Update All In One Login to a version later than 2.4.1
Review login page customizations for injected scripts
Check the EUVD entry for patch status
What the sources say 3
· Mastodon: “The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to...” Source
· Mastodon: “Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.” Source
· Mastodon: “Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.” Source