{"id":"CVE-2026-103071","published":"2026-10-10T17:16:59.673","lastModified":"2026-10-13T13:28:15.717","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-thank-you-page-customizer/vulnerability/wordpress-thank-you-page-customizer-for-woocommerce-plugin-1-2-3-content-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to inject malicious code into the Thank You Page Customizer plugin, potentially leading to arbitrary code execution on affected WooCommerce sites. The flaw occurs when user input is not properly sanitized before being used in code generation.","exploitability":"Exploitation appears straightforward with no special preconditions required, as the vulnerability affects the core plugin functionality without requiring authentication or specific user interaction.","blast_radius":"If exploited, this could allow attackers to execute arbitrary code on WooCommerce sites using the affected plugin version, potentially leading to full site compromise and data exfiltration.","remediation":"Upgrade to version 1.2.4 or later to remediate this code injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["code-injection","woocommerce","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:11:29.816Z"}}