CVE-2026-32550 HIGH

CVE-2026-32550: WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability

Vendor Liquid Web, Llc
Product Kadence Shop Kit
Weakness CWE-89 · SQLi
Published August 27, 2026
Last update August 27, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Kadence Shop Kit versions up to 3.0.6 contain a SQL injection vulnerability that allows authenticated users to query the database directly. An attacker with low-level site access can extract sensitive data or disrupt database operations. The vulnerability requires valid login credentials but no additional user interaction.

What an attacker can do

03Attacker Capabilities

Extract sensitive data from the database or cause database errors and service disruption.

Potential impact on your site

04Site Impact

Unauthorized database access and potential data breach affecting all site users and customer information.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level privileges on the site.

Key dates

06Disclosure timeline

August 27, 2026 CVE published
August 27, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-28184 WordPress Form Maker by 10Web plugin <= 1.15.44 - SQL Injection vulnerability CVE-2026-66446 WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability CVE-2026-15453 KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter CVE-2026-66430 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability CVE-2026-74804 Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64