Ecomail <= 2.4.3 - Authenticated (Contributor+) Missing Authorization to Bulk Data Synchronization and List Refresh
- ID
- WPSEC-2026-0159
- Plugin
- Ecomail (ecomail)
- Affected
- all versions before 2.5.0
- Remediation
- Update to 2.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Not seen · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Ecomail on WPSec AttackSurface
- Fix released
- Published
Description
The Ecomail plugin for WordPress is vulnerable to unauthorized actions in all versions up to, and including, 2.4.3 due to a missing capability check on the admin_action handlers for bulk user upload, bulk user and order upload, order update scheduling, and list refresh. This makes it possible for authenticated attackers, with Contributor-level access and above, to trigger a bulk upload of all site users and their orders to the configured Ecomail list (with double opt-in confirmation skipped) and refresh the configured lists. WooCommerce, which the plugin requires, blocks wp-admin access for users without the edit_posts capability, so Subscriber and Customer accounts cannot reach these handlers on a default configuration.
References
- https://wpsec.com/vuln/WPSEC-2026-0159/
- https://plugins.svn.wordpress.org/ecomail/tags/2.5.0/
- https://wordpress.org/plugins/ecomail/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS