CVE-2025-11237: 
WordPress Analyse et atténuation des vulnérabilités

The Make Email Customizer for WooCommerce plugin version 1.0.6 and earlier contains a vulnerability that allows any authenticated user with Subscriber or higher privileges to perform arbitrary options updates in WordPress. The vulnerability was discovered and publicly disclosed on October 21, 2025 (WPScan).

The vulnerability stems from improper authorization checks and option validation in the plugin's AJAX actions. The issue has been assigned a CVSS score of 8.8 (High) and is classified under CWE-862 (Broken Access Control). The vulnerability allows authenticated users to manipulate WordPress options through AJAX endpoints 'savemeta' and 'ecsave_option' without proper authorization validation (WPScan).

The vulnerability enables authenticated users with minimal privileges (Subscriber level) to modify critical WordPress settings, including enabling public registration and changing default user roles to administrator. This could lead to privilege escalation and unauthorized administrative access to the WordPress installation (WPScan).

Currently, there is no known fix available for this vulnerability. Site administrators using the affected plugin versions should consider disabling the plugin until a security patch is released (WPScan).