CVE-2026-12136 phppoet CVE debrief

Who should care

Users of the Customize My Account For Woocommerce plugin for WordPress, particularly those with Contributor-level access and above, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability exists in the Customize My Account For Woocommerce plugin for WordPress, specifically in the 'sysbasics_user_avatar' shortcode. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes (min_height, min_width, max_height, max_width) in the wcmamtx_get_avatar_default() function. These attributes are concatenated unescaped into the get_avatar() extra_attr style attribute, allowing authenticated attackers with Contributor-level access and above to inject arbitrary web scripts. These scripts will execute whenever a user accesses an injected page.

Defensive priority

Medium priority due to the CVSS score of 6.4 and the potential for authenticated attackers to inject arbitrary web scripts.

Recommended defensive actions

• Update the Customize My Account For Woocommerce plugin to a version beyond 4.3.6.
• Restrict access to the plugin's functionality to prevent Contributor-level access and above for untrusted users.
• Implement additional security measures such as Web Application Firewall (WAF) rules to detect and prevent cross-site scripting attacks.
• Regularly monitor the plugin for updates and security advisories.
• Consider implementing a Content Security Policy (CSP) to further mitigate the risk of cross-site scripting attacks.

Evidence notes

The CVE record was published on 2026-06-18T08:16:33.490Z and was last modified on 2026-06-18T15:23:56.087Z. The NVD entry is currently Deferred. The vulnerability was reported by [email protected].

Official resources