ShopMagic up to 4.9.0 - Unauthenticated Local File Inclusion (CVE-2026-103367)

ShopMagic versions through 4.9.0 contain a high-severity local file inclusion vulnerability that can allow an unauthenticated attacker to include and execute a PHP file already present on the server. Wordfence assigned CVE-2026-103367 a CVSS score of 8.1. WooCommerce stores should update to ShopMagic 4.9.1 or later.

Table of Contents

Vulnerability summary

Product: ShopMagic – email automation for WordPress
Plugin slug: shopmagic-for-woocommerce
Affected versions: 4.9.0 and earlier
Fixed version: 4.9.1
CVE: CVE-2026-103367
Severity: High, CVSS 8.1
Authentication required: No
Impact: Local PHP file inclusion and possible code execution

Exploit prerequisites

The vulnerable path is reached when a published ShopMagic automation processes the {{ customer.first_name }} placeholder. Wordfence reports that the built-in “New Order email with social media profile links” recipe satisfies this condition. On a store that permits guest checkout, an unauthenticated customer can control the WooCommerce billing first-name value that reaches the placeholder.

How the flaw works

ShopMagic 4.9.0 and earlier do not safely constrain the value used while resolving the customer first-name placeholder. A crafted billing first name can influence a local include operation. Exploitation is limited to files already present on the server, but inclusion of a PHP file can execute its code in the WordPress process and compromise the site.

This is not a generic remote upload flaw. The attacker needs the vulnerable recipe or another published automation using the affected placeholder, and a checkout path that accepts the attacker-controlled customer value. Those prerequisites should be checked on every ShopMagic installation rather than assumed.

Immediate remediation

Update ShopMagic to version 4.9.1 or later.
Until the update is complete, unpublish automations that process {{ customer.first_name }}, especially the affected built-in recipe.
If you cannot patch or review automations immediately, deactivate ShopMagic. Temporarily disabling guest checkout can reduce exposure but is not a substitute for patching.
Review recent guest orders and web-server logs for suspicious billing first-name values containing traversal sequences, PHP stream-wrapper strings, or local filesystem paths.
If exploitation is suspected, rotate WordPress and hosting credentials, invalidate sessions, and investigate plugin, theme, mu-plugin, upload, and scheduled-task changes.

Verification with WP-CLI

wp plugin get shopmagic-for-woocommerce --fields=name,status,version,update,update_version
wp core verify-checksums
wp plugin verify-checksums --all
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --format=table

Confirm that ShopMagic is at least 4.9.1, then inspect published automations in WooCommerce → Automations for the affected placeholder. Review order records and access logs together: suspicious input may be stored in an order even when the HTTP request itself looks like normal checkout traffic.

Indicators to review

Guest orders with unusual billing first-name values containing path separators, traversal markers, wrapper names, or server paths.
ShopMagic automation runs immediately following suspicious checkout requests.
Unexpected PHP execution, new files, modified plugin or theme files, unfamiliar administrators, or outbound connections after an anomalous order.
Repeated failed checkout attempts that vary only the billing first-name field.

At publication time, WPDeeply did not find authoritative confirmation that CVE-2026-103367 is in CISA’s Known Exploited Vulnerabilities catalog. No active-exploitation claim is made here; this advisory is based on the disclosed vulnerable code path and its practical unauthenticated checkout preconditions.

ShopMagic up to 4.9.0 – Unauthenticated Local File Inclusion (CVE-2026-103367)