PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42668 Omnisend CVE debrief

CVE-2026-42668 is a high-severity vulnerability affecting the Email Marketing for WooCommerce by Omnisend plugin, specifically versions <= 1.18.0. This vulnerability is categorized as Unauthenticated Broken Authentication, with a CVSS score of 7.5 and a severity rating of HIGH.

Vendor
Omnisend
Product
Email Marketing for WooCommerce by Omnisend
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-15
Advisory published
2026-06-15
Advisory updated
2026-06-15

Who should care

Users of the Email Marketing for WooCommerce by Omnisend plugin, specifically those using versions <= 1.18.0, should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability is caused by a broken authentication mechanism in the Email Marketing for WooCommerce by Omnisend plugin. This allows unauthenticated attackers to potentially access sensitive information.

Defensive priority

HIGH

Recommended defensive actions

  • Update the Email Marketing for WooCommerce by Omnisend plugin to a version greater than 1.18.0.
  • Review and restrict access to sensitive areas of the plugin.

Evidence notes

The CVE was published on 2026-06-15T21:16:56.637Z and modified on 2026-06-15T21:24:32.790Z. The vulnerability was reported by Patchstack.

Official resources

CVE-2026-42668 was published on 2026-06-15T21:16:56.637Z and modified on 2026-06-15T21:24:32.790Z.