CVE-2026-42668: WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerability

Synopsis

This is a broken authentication vulnerability in the Email Marketing for WooCommerce by Omnisend WordPress plugin, affecting all versions up to and including 1.18.0. The vulnerability is reachable over the network with no authentication and no user interaction required, making it accessible to any unauthenticated remote attacker. Successful exploitation gives an attacker unauthorized access to confidential data exposed through the plugin's authentication flow. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress/WooCommerce service via HTTP(S) to exploit this vulnerability.

• AuthenticationNot required

  No account or credentials of any kind are required; the vulnerability is exploitable by any unauthenticated remote request.

• Victim interactionNot required

  No action from a logged-in user or site visitor is needed for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or non-standard configuration.

Blast Radius

• An attacker reads confidential data exposed through the plugin's authentication mechanism, which may include API keys, subscriber lists, or integration credentials stored by the Omnisend plugin.
• Access to marketing integration credentials can expose customer email addresses and behavioral data synced between WooCommerce and the Omnisend platform.
• There is no integrity or availability impact reported; the attacker gains read access only, with no write or disruption capability described in the CVSS scoring.