CVE-2025-11237

Medium · 5.3

CVSS

5.3

EPSS

0.3%

Published

Nov 11, 2025

CISA due date

—

The record

The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.

Affected packages

Ecosystem	Package	Introduced	Fixed