Skip to content
OpenAdvisories

Product · WP Desk

ShopMagic – email automation for WordPress

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-103367

    ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter

    The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attacker…

    WP Desk ShopMagic – email automation for WordPress Web / CMS