CVE-2025-11237 — Make Email Customizer for WooCommerce <= 1.0.6 - Subscriber+ Arbitrary Options Update

CVE-2025-11237

Make Email Customizer for WooCommerce <= 1.0.6 - Subscriber+ Arbitrary Options Update PUBLISHED

Description (CNA)

The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.

Affected (CNA)

Vendor / product	Versions
Unknown / Make Email Customizer for WooCommerce	affected 0 through 1.0.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/88b46752-051b-4468-9e2b-cc81a9ce1075/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.