TI-2021-04005 Aliases CVE-2021-20779 GHSA-76mh-x8fp-m6p4

Cross-site request forgery in codemiq WordPress Email Template Designer - WP HTML Mail

MEDIUM 40CWE-352Published 2021-07-07 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Why it matters now

EPSS 0.0087 59th percentileScored 2026-11-07

Fix Fixed WordPress Email Template Designer - WP HTML Mail (codemiq): 3.0.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
codemiq	WordPress Email Template Designer - WP HTML Mail	before 3.0.8	3.0.8	Patch available	CNA

WordPress Email Template Designer - WP HTML Mail Vendorcodemiq Affected before 3.0.8 Fixed in 3.0.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:codemiq:wordpress_email_template_designer::::::wordpress::*	before 3.0.8	Vulnerable	codemiq

cpe:2.3:a:codemiq:wordpress_email_template_designer:*:*:*:*:*:wordpress:*:* Versions before 3.0.8 Vulnerable ·codemiq

Remediation

Fix · CNA WordPress Email Template Designer - WP HTML Mail (codemiq) Fixed in 3.0.8

Timeline

2026-10-02 Threatist record created from CVE-2021-20779
2026-10-03 Alias added: GHSA-76mh-x8fp-m6p4

References

Advisory 2

Other 1

https://codemiq.com/en/

TI-2022-00155 WP HTML Mail <= 3.0.9 Missing Authorization on REST-API Route CVSS 3.1HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences