CVE-2026-28005 CRITICAL

CVE-2026-28005: WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability

Vendor Nexcess
Product Kadence WooCommerce Email Designer
Weakness CWE-862 · Missing authorization
Published August 6, 2026
Last update August 6, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Kadence WooCommerce Email Designer plugin through version 1.5.19 lacks proper authorization checks, allowing unauthenticated attackers to read, modify, or delete sensitive data and functionality. An attacker can exploit this over the network without special conditions. This affects all installations running the vulnerable version.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete site data and email templates without logging in.

Potential impact on your site

04Site Impact

Attackers can compromise email campaigns, steal customer data, and disrupt WooCommerce operations without any credentials.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 6, 2026 CVE published
August 6, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-15411 StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action CVE-2026-28147 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability CVE-2026-66699 WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability CVE-2026-12124 PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter CVE-2026-13110 StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action