Loading vulnerability…
Code Injection in VillaTheme Thank You Page Customizer for WooCommerce
CVE-2026-103071 is a code injection vulnerability in VillaTheme Thank You Page Customizer for WooCommerce affecting versions through 1.2.3. Improper control of code generation permits code injection. The vulnerable function, injection mechanism, and execution context are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits code injection. Execution privileges and the extent of potential compromise are currently unknown.
If you can’t patch tonight, do this now.
No vendor workaround is identified. As a precaution pending a verified fix, consider disabling the affected plugin if operationally feasible.
Patch, then assume compromise.
A fixed version or patch has not been identified. Obtain a vendor-confirmed patched release and upgrade when available; versions later than 1.2.3 should not be assumed fixed without confirmation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.