Omnisend for WooCommerce <= 1.18.0 - Unauthenticated Omnisend Account Takeover via Predictable Connect Token

The Omnisend for WooCommerce plugin for WordPress is vulnerable to an unauthenticated account takeover via insufficiently random values in versions up to, and including, 1.18.0. This is due to the generate_install_url() function deriving the OAuth connect token solely from the Unix timestamp at page-load time (hash('sha256', time())), which yields only ~86,400 distinct values per day and is trivially brute-forceable. This makes it possible for unauthenticated attackers to predict the connect token, authenticate to the POST /wp-json/omnisend-api/v1/connect REST endpoint, and replace the store's omnisend_api_key and brand_id with attacker-supplied values, redirecting all customer PII synchronization, order webhooks, and marketing communications to the attacker's Omnisend account.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Email Marketing for WooCommerce by Omnisend 1.18.1 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts