CVE-2026-103367 in ShopMagic Plugin
Summary
by MITRE • 10/15/2026
The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The ShopMagic WordPress plugin, designed to facilitate email automation for e-commerce workflows, contains a critical Local File Inclusion vulnerability affecting all versions up to and including 4.9.0. This flaw resides within the handling of the 'billing_address.first_name' parameter during checkout processes. The core technical issue stems from insufficient input validation and sanitization when processing user-supplied data that is subsequently used in file inclusion operations. Because the plugin dynamically constructs paths or references based on this input without adequately restricting allowed characters or validating against a whitelist, an attacker can manipulate the variable to point towards arbitrary files on the server's filesystem rather than intended template locations. This type of vulnerability aligns with CWE-98 Improper Control of Filename for Include/Require Statement in PHP Programs and represents a severe risk as it allows external control over file paths that are then executed by the web server environment.
The operational impact of this vulnerability is significant due to its unauthenticated nature, meaning no prior login or valid session is required to exploit it. The attack vector specifically targets the guest checkout process where customers input their billing information. When a user submits an order with a crafted payload in the first name field, the application processes this data and inadvertently includes the specified file. If the attacker can upload malicious PHP files to accessible directories on the server, they can trigger execution of that code through this inclusion mechanism. This capability effectively bypasses standard access controls because it does not rely on authentication tokens or nonces but rather exploits the logic flow within the plugin's template rendering engine. Consequently, an attacker gains the ability to execute arbitrary PHP code with the privileges of the web server process, which typically has read and write access to the entire WordPress installation directory structure.
Exploitation is particularly dangerous in default configurations because ShopMagic ships with pre-configured recipes that automatically trigger this vulnerability path without any custom setup required by the administrator. The built-in recipe for sending a New Order email containing social media profile links processes customer data, including the first name field, making it directly susceptible to exploitation out of the box. This means that even sites using standard settings are vulnerable if they accept guest checkouts or allow unauthenticated users to submit forms that interact with this specific parameter. The ability to execute arbitrary code allows attackers to perform a wide range of malicious activities, including but not limited to stealing sensitive database credentials stored in wp-config.php, defacing the website by modifying core files, installing backdoors for persistent access, or pivoting to attack other systems within the same network infrastructure. This behavior is consistent with ATT&CK techniques involving Server Side Request Forgery and Local File Inclusion used to achieve initial code execution on remote servers.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary recommendation is to update the ShopMagic plugin to a version newer than 4.9.0, where this vulnerability has been patched by implementing strict input validation and ensuring that file inclusion operations are restricted to predefined safe directories or files only. Administrators should also review server configurations to restrict PHP execution in upload directories if possible, thereby limiting the impact even if an attacker manages to upload a malicious script. Additionally, enabling Web Application Firewall rules can help detect and block common patterns associated with Local File Inclusion attacks, such as directory traversal sequences like ../ or attempts to include system files. Regular security audits and monitoring of server logs for unusual file access patterns are also essential components of defending against this class of vulnerability in WordPress environments.