WordPress Plugin Vulnerabilities

Email Customizer for WooCommerce | Drag and Drop Email Templates Builder < 2.6.1 - Information Exposure

Description

The Email Customizer for WooCommerce | Drag and Drop Email Templates Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.0 via the prepare_preview() function. This makes it possible for unauthenticated attackers to preview emails templates.

Affects Plugins

Plugin icon
email-customizer-for-woocommerce
Fixed in 2.6.1

References

CVE
CVE-2024-32781
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e25015c9-d764-44b2-ad54-edf5d248e56c

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Emili Castells
Verified
No
WPVDB ID
f8b573bc-181c-496a-b6a4-a62007101d6e

Timeline

Publicly Published
2024-04-22 (about 2 years ago)
Added
2024-04-30 (about 2 years ago)
Last Updated
2024-04-30 (about 2 years ago)

Other

Published
Title
Published
2022-06-28
Title
SP Project & Document Manager < 4.58 - Sensitive File Disclosure
Published
2026-07-09
Title
Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action
Published
2024-07-11
Title
Olive One Click Demo Import <= 1.1.2 - Unauthenticated Information Exposure
Published
2025-05-07
Title
Mail Mint < 1.17.8 - Unauthenticated Sensitive Information Exposure
Published
2025-02-11
Title
Hide My WP Ghost < 5.4.01 - Hidden Login Page Disclosure