CVE-2025-11237

CVE-2025-11237

Medium · published November 11, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00295 · 21.1th percentile
Published
2025-11-11T11:15Z
References (1)
https://wpscan.com/vulnerability/88b46752-051b-4468-9e2b-cc81a9ce1075/ · [email protected]
EPSS history
Timeline
  • 11 NOV 06:00Z
    Make Email Customizer for WooCommerce <= 1.0.6 - Subscriber+ Arbitrary Options Update
    cvelistv5