CVE-2026-42668: Omnisend Email Marketing WooCommerce Authentication Bypass (CVSS 7.5)

Technical summary

CVE-2026-42668 is a broken authentication vulnerability (CWE-288) in the Omnisend Email Marketing for WooCommerce plugin versions up to and including 1.18.0. The vulnerability allows unauthenticated access to protected API endpoints or administrative functions related to email marketing operations. The attack vector is network-based with low attack complexity, meaning the flaw can be exploited directly without requiring special conditions, elevated privileges, or user interaction. The CVSS 3.1 score of 7.5 (HIGH) reflects the high confidentiality impact—attackers can read sensitive email marketing data, customer contact lists, campaign configurations, and potentially personally identifiable information—without the ability to modify or delete data from the perspective of this CVE's scoring.

Business impact

Organizations using the Omnisend Email Marketing plugin may face exposure of customer email addresses, marketing campaign details, subscriber preferences, and potentially sensitive business intelligence. Depending on data stored within the plugin, this could include GDPR-regulated personal data, creating compliance obligations. Reputational harm, regulatory fines, and breach notification costs are realistic consequences. If attackers gain access to email campaign infrastructure, they could leverage that foothold for further lateral movement within the WooCommerce environment or associated WordPress systems.

Affected systems

Any WooCommerce installation with the Email Marketing for WooCommerce plugin by Omnisend version 1.18.0 or earlier is affected. This includes self-hosted WordPress sites using WooCommerce as an e-commerce platform. Organizations running outdated or unpatched instances of the plugin are at immediate risk. The vulnerability does not appear to be limited by specific WordPress versions or WooCommerce configurations based on available information.

Exploitability

This vulnerability has a low barrier to exploitation. No authentication is required, no user interaction is necessary, and the attack can be performed over the network. An attacker needs only knowledge that an affected Omnisend plugin is active on a target WooCommerce store and can craft direct API requests to bypass authentication controls. Given the straightforward nature of broken authentication flaws, exploitation is technically straightforward and does not require advanced capabilities or zero-day techniques.

Remediation

Immediately update the Email Marketing for WooCommerce plugin by Omnisend to a version newer than 1.18.0. Administrators should verify the latest patched version against the official Omnisend plugin repository or the vendor's security advisories. As an interim mitigation, consider disabling or deactivating the plugin if immediate patching is not possible, though this may impact email marketing operations. Review access logs and API activity within the plugin for signs of unauthorized access following the vulnerability publication date.

Patch guidance

Update the Omnisend Email Marketing for WooCommerce plugin to the latest available version beyond 1.18.0 by navigating to Plugins > Installed Plugins in the WordPress admin dashboard and clicking 'Update' next to the Omnisend plugin. Verify the new version number against the official Omnisend plugin page or security advisory to confirm you are installing a patched release. Test the plugin's email marketing functionality after updating to ensure no configuration or data loss occurred. If automatic updates are enabled, ensure they have completed successfully.

Detection guidance

Monitor WooCommerce and WordPress access logs for unusual API requests to email marketing endpoints, particularly those originating from unexpected IP addresses or showing patterns inconsistent with normal administrative activity. Check plugin access logs for unauthenticated requests to functions or endpoints that should require authentication. Utilize Web Application Firewall (WAF) rules to detect or block suspicious requests to the Omnisend plugin's known API paths. Security Information and Event Management (SIEM) systems can correlate authentication bypass attempts across multiple requests or time periods. Verify the installed plugin version regularly through WordPress admin dashboards or automated scanning tools.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score, ease of exploitation, and the sensitive nature of email marketing data. The lack of authentication requirements combined with high confidentiality impact means any attacker on the internet can potentially access customer data without technical barriers. While not yet flagged in the CISA KEV catalog, the vulnerability's straightforward nature makes active exploitation likely once public disclosure is complete. Organizations handling customer PII through email marketing should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is justified by the network attack vector (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), no user interaction needed (UI:N), and high confidentiality impact (C:H). The attack scope is unchanged (S:U), meaning the impact is confined to the vulnerable component. While integrity and availability are not directly impacted (I:N, A:N), the unauthorized disclosure of sensitive customer and business data creates significant organizational and regulatory risk. The high score reflects the ease and impact of exploitation despite the absence of direct data modification or service disruption.

Frequently asked questions