WordPress Plugin Vulnerabilities

Kadence WooCommerce Email Designer < 1.5.19.1 - Unauthenticated Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation, making it possible for unauthenticated attackers to elevate their privileges.

Affects Plugins

Plugin icon
kadence-woocommerce-email-designer
Fixed in 1.5.19.1

References

CVE
CVE-2026-28005
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/159304a1-b015-44cd-9540-88b3e306dcc8

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
a9a6e55e-bbae-4aac-8f21-8dec2206b22f

Timeline

Publicly Published
2026-08-04 (about 2 months ago)
Added
2026-08-14 (about 2 months ago)
Last Updated
2026-10-16 (about 10 hours ago)

Other

Published
Title
Published
2026-08-29
Title
Custom User Registration Fields for WooCommerce < 2.2.4 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout
Published
2025-08-29
Title
PostX < 4.1.36 - Authenticated (Editor+) Privilege Escalation
Published
2026-03-20
Title
App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter
Published
2026-10-13
Title
User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler
Published
2025-08-15
Title
WPGYM <= 67.7.0 - Missing Authorization to Admin Account Creation