CVE-2026-103071

Summary

This vulnerability allows attackers to inject malicious code into the Thank You Page Customizer plugin, potentially leading to arbitrary code execution on affected WooCommerce sites. The flaw occurs when user input is not properly sanitized before being used in code generation.

Exploitability

Exploitation appears straightforward with no special preconditions required, as the vulnerability affects the core plugin functionality without requiring authentication or specific user interaction.

Blast radius

If exploited, this could allow attackers to execute arbitrary code on WooCommerce sites using the affected plugin version, potentially leading to full site compromise and data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.2.4 or later to remediate this code injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.