Email Customizer for WooCommerce Pro: Customer-to-RCE PHP File Write

Threat Overview

A high-severity Remote Code Execution (RCE) vulnerability disclosed in Email Customizer for WooCommerce (Pro) allows any authenticated user with Subscriber-level or Customer-level access to write arbitrary PHP code into executable files on the web server.

Tracked as CVE-2026-81534 (CVSS 8.8), the flaw resides in the plugin’s test-email dispatch routine (send_test_mail()). Because almost every WooCommerce storefront allows shoppers to register a free Customer account during checkout, this low-privilege flaw serves as an immediate server takeover vector for online stores.

The Breakdown: How the Exploit Works

Store owners use Email Customizer for WooCommerce Pro to design branded transactional emails for order confirmations and receipts. To preview templates before sending them to buyers, the plugin includes a send_test_mail() function that writes template output inside wp-content/uploads/.

In versions up to and including 3.9.5, send_test_mail() fails to verify store-management capabilities (manage_woocommerce or manage_options), and fails to sanitize user-controlled input before writing content to disk.

An attacker can register a standard Customer account, invoke send_test_mail() with a crafted PHP payload, and force the plugin to write an executable .php file directly into wp-content/uploads/. Requesting that newly written file over HTTP executes the attacker’s code on the host server.

The Operational Risk: What an Attacker Gains

• Full Ecommerce Server Compromise: Attackers execute arbitrary PHP and operating-system commands under the web server’s system account, bypassing all WordPress role boundaries.
• Payment Skimmer Injection: Intruders on compromised WooCommerce servers routinely inject digital credit-card skimmers into checkout scripts to harvest buyer payment cards in real time.
• Customer & Order Database Theft: Attackers gain direct read access to the WooCommerce database, exfiltrating order histories, billing addresses, and payment gateway API keys.
• Persistent Backdoor Implants: Malicious PHP scripts planted inside wp-content/uploads/ survive plugin updates and password resets unless removed during a forensic file audit.

Our Take in Plain English

“When you run an online store on WordPress, you have to let customers create accounts to track orders. The hidden danger is that every plugin installed on your store—even a cosmetic tool that styles email receipts—exposes its internal functions to those same customer accounts unless the developer writes strict permission checks. One missing capability check in an email template tool lets a fake shopper write executable code onto your server. Decoupled cloud commerce separates the public storefront from backend order services and renders transactional emails inside isolated API workers with zero writable public filesystem.”

The Modern Architectural Remedy

• Legacy Dynamic WooCommerce: Runs customer authentication, checkout processing, and third-party email plugins inside a single shared PHP server with writable public upload folders.
• Decoupled Pre-Rendered Commerce Architecture: Delivers the public storefront from immutable global edge nodes while routing checkout and transactional emails through isolated, API-first commerce microservices.

Immediate Action Items for WordPress Operators

1. Patch Email Customizer Pro Immediately: Upgrade Email Customizer for WooCommerce (Pro) past version 3.9.5, or deactivate the plugin until patched.
2. Disable PHP Execution in Uploads: Configure web server rules to deny .php script execution inside wp-content/uploads/.
3. Audit Customer Registrations: Review recent user accounts and access logs for calls to send_test_mail.
4. Scan Upload Directories: Inspect wp-content/uploads/ for unauthorized .php or .phtml files.