CVE-2026-103358 VillaTheme CVE debrief

Who should care

Defenders and administrators using the Email Template Customizer for WooCommerce plugin, especially in WordPress environments, should be aware of this vulnerability and take necessary actions to mitigate it.

Why it matters

CVE-2026-103358 is a high-severity vulnerability in the Email Template Customizer for WooCommerce plugin, allowing potential code injection. Defenders should prioritize patching and monitoring.

• Potential code injection, allowing for malicious code execution.
• High CVSS score indicating a severe vulnerability.
• Affected versions are widely used, increasing the attack surface.

Technical summary

The Email Template Customizer for WooCommerce plugin, versions up to and including 1.3.4, is vulnerable to code injection due to improper control of code generation. This could potentially allow an attacker to inject malicious code, leading to code execution. The vulnerability has a high CVSS score of 7.5, indicating a severe vulnerability. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where the plugin is used. The affected versions are widely used, increasing the attack surface.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where the plugin is used.

Recommended defensive actions

• Patch or update the Email Template Customizer for WooCommerce plugin to version 1.3.5 or later.
• Review and restrict user input to prevent potential code injection.
• Monitor for suspicious activity related to the plugin.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its CVSS score and affected versions. The Email Template Customizer for WooCommerce plugin, versions up to and including 1.3.4, is vulnerable to code injection due to improper control of code generation. The official CVE Program record and NIST NVD detail page provide additional information about the vulnerability. Defenders should verify the affected scope and severity, and review vendor guidance for patching or mitigating the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.