CVE-2026-103367

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billingaddress.firstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php...

CVE-2026-103367 ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billingaddress.firstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php...

CVE-2026-103367

The ShopMagic – email automation for WordPress plugin is vulnerable to an Unauthenticated Local File Inclusion (LFI) in all versions up to and including 4.9.0 . The vulnerability exists via the billing_address.first_name parameter, where a lack of proper input sanitization allows attackers to inc...

EUVD-2026-100903

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billingaddress.firstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php...