IT SBIT Services
Schneeberger
DEEN
CVE tracker

WP Desk ShopMagic: Unauthenticated Local File Inclusion via billing first name

CVE-2026-103367High 8.1

← All vulnerabilities

Summary

ShopMagic – email automation for WordPress, a WooCommerce extension for automated emails, contains a Local File Inclusion flaw in all versions up to and including 4.9.0. According to the CVE description, an unauthenticated attacker can include and execute arbitrary .php files on the server by submitting a guest checkout with a crafted billing first name, provided a published recipe processes the customer first name placeholder. Depending on the server setup, this can lead to access control bypass, exposure of sensitive data or code execution. The CVSS 3.1 base score is 8.1 (HIGH) with high attack complexity, no privileges and no user interaction required.

Affected

  • ShopMagic – email automation for WordPress (slug shopmagic-for-woocommerce) up to and including 4.9.0
  • Per the CVE description, the default recipe 'New Order email with social media profile links' meets the exploitation condition (not independently verified)

Fixed in

Unknown. The CVE references plugin tag 4.9.1 as a possible fix, but no vendor advisory confirms this. For the related CVE-2026-114195, a source names 4.9.2 as the solution.

Workaround

  • No vendor-published workaround known.
  • Review and disable recipes that use the customer first name placeholder until the update is installed (suggestion, not a vendor recommendation).
  • Review web server logs for unusual guest-checkout billing names and unexpected access to PHP files.

Exploitation

  • CISA KEV: not listed.
  • No public proof of concept detected by one aggregator (low confidence, metadata inconsistent).
  • No reports of exploitation in the wild found at the time of writing.
  • CISA SSVC: exploitation none, automatable no, technical impact total.
  • EPSS 0.01007 per one aggregator (not authoritative).

Our recommendation

  • Inventory all WordPress sites with ShopMagic and record the installed version.
  • Update to the latest release from the WordPress.org plugin page; treat 4.9.2 or later as the target version.
  • Check whether active recipes use the customer first name placeholder and disable them if not needed.
  • Monitor the Wordfence and CISA KEV entries for changes in exploitation status.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:11.

Original description (NVD)

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed