What’s Vulnerable › Vulnerabilities

CVE-2022-0218: WP HTML Mail <= 3.0.9 Missing Authorization on REST-API Route

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 66.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-04 · updated 2026-06-17
• Weakness: CWE-79

Description

The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.

Affected products

• codemiq WordPress Email Template Designer - WP HTML Mail: through 3.0.9

References

• https://plugins.trac.wordpress.org/changeset/2656984/wp-html-mail/trunk/includes/class-template-designer.php
• https://www.wordfence.com/blog/2022/01/unauthenticated-xss-vulnerability-patched-in-html-email-template-designer-plugin/
• https://plugins.trac.wordpress.org/changeset/2656984/wp-html-mail/trunk/includes/class-template-designer.php
• https://www.wordfence.com/blog/2022/01/unauthenticated-xss-vulnerability-patched-in-html-email-template-designer-plugin/

Get alerted when CVE-2022-0218 or the next vulnerability affects your stack