Omnisend for WooCommerce <= 1.18.0 — Unauthenticated Omnisend Account Takeover via Predictable Connect Token

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Email Marketing for WooCommerce by Omnisend.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 1.18.1, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Email Marketing for WooCommerce by Omnisend to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to 0xzenko.

The Omnisend for WooCommerce plugin for WordPress is vulnerable to an unauthenticated account takeover via insufficiently random values in versions up to, and including, 1.18.0. This is due to the generate_install_url() function deriving the OAuth connect token solely from the Unix timestamp at page-load time (hash('sha256', time())), which yields only ~86,400 distinct values per day and is trivially brute-forceable. This makes it possible for unauthenticated attackers to predict the connect token, authenticate to the POST /wp-json/omnisend-api/v1/connect REST endpoint, and replace the store's omnisend_api_key and brand_id with attacker-supplied values, redirecting all customer PII synchronization, order webhooks, and marketing communications to the attacker's Omnisend account.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. May 13, 2026

   CVE published

   Severity high, CVSS 7.5

2. Nov 13, 2026

   Record last updated