Vulnerabilities / Ecomail / WPSEC-2026-0158
Ecomail <= 2.4.3 - Unauthenticated Missing Authorization to Arbitrary Cart Tracking Events via 'email' Parameter
Medium 5.3
CWE-639Fixed in 2.5.0
- ID
- WPSEC-2026-0158
- Plugin
- Ecomail (ecomail)
- Affected
- all versions before 2.5.0
- Remediation
- Update to 2.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Not seen · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Ecomail on WPSec AttackSurface
- Fix released
- Published
Description
The Ecomail plugin for WordPress is vulnerable to unauthorized data submission via the ecomail/v1/cart REST endpoint in all versions up to, and including, 2.4.3 due to the route having no permission check and trusting client-supplied 'email' and 'items' parameters. This makes it possible for unauthenticated attackers to send arbitrary cart tracking events to the site's Ecomail account on behalf of any email address, polluting customer data and potentially triggering abandoned-cart automations.
References
- https://wpsec.com/vuln/WPSEC-2026-0158/
- https://plugins.svn.wordpress.org/ecomail/tags/2.5.0/
- https://wordpress.org/plugins/ecomail/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS