Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro <= 7.5.2 - Unauthenticated Arbitrary Shortcode Execution via Subscribe Form Fields
- ID
- WPSEC-2026-2864
- Plugin
- Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro (back-in-stock-notifier-for-woocommerce)
- Affected
- from 1.10.2 before 7.5.3
- Remediation
- Update to 7.5.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro on WPSec AttackSurface
- Fix released
- Published
Description
The Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro plugin for WordPress is vulnerable to arbitrary shortcode execution via the subscribe form's name and phone fields in all versions up to, and including, 7.5.2. This is due to the plugin storing these values without removing shortcode brackets, then putting them into the email subject and message templates before do_shortcode() runs on the result. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on the server when subscription and back-in-stock emails are prepared. This also happens when the admin copy email is not enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2864/
- https://plugins.svn.wordpress.org/back-in-stock-notifier-for-woocommerce/tags/7.5.3/
- https://wordpress.org/plugins/back-in-stock-notifier-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS