# Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro <= 7.5.2 - Unauthenticated Arbitrary Shortcode Execution via Subscribe Form Fields

- **ID:** WPSEC-2026-2864
- **Plugin:** Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro (`back-in-stock-notifier-for-woocommerce`), https://wordpress.org/plugins/back-in-stock-notifier-for-woocommerce/
- **Affected versions:** from 1.10.2 before 7.5.3
- **Fixed in:** 7.5.3 (Update to 7.5.3 or later.)
- **Severity:** High 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/back-in-stock-notifier-for-woocommerce
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2864/

## Description

The Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro plugin for WordPress is vulnerable to arbitrary shortcode execution via the subscribe form's name and phone fields in all versions up to, and including, 7.5.2. This is due to the plugin storing these values without removing shortcode brackets, then putting them into the email subject and message templates before do_shortcode() runs on the result. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on the server when subscription and back-in-stock emails are prepared. This also happens when the admin copy email is not enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2864/
- https://plugins.svn.wordpress.org/back-in-stock-notifier-for-woocommerce/tags/7.5.3/
- https://wordpress.org/plugins/back-in-stock-notifier-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2864/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.