WordPress Plugin Vulnerabilities

Kadence WooCommerce Email Designer < 1.5.19.1 - Unauthenticated Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation, making it possible for unauthenticated attackers to elevate their privileges.

Affects Plugins

Plugin icon
kadence-woocommerce-email-designer
Fixed in 1.5.19.1

References

CVE
CVE-2026-28005
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/159304a1-b015-44cd-9540-88b3e306dcc8

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
a9a6e55e-bbae-4aac-8f21-8dec2206b22f

Timeline

Publicly Published
2026-08-04 (about 20 days ago)
Added
2026-08-14 (about 9 days ago)
Last Updated
2026-08-21 (about 2 days ago)

Other

Published
Title
Published
2021-04-14
Title
Plus Addons for Elementor < 2.0.7 - Contributor+ Privilege Escalation
Published
2026-01-22
Title
Membership <= 1.6.4 - Subscriber+ Privilege Escalation
Published
2026-03-25
Title
Amelia Booking 8.3 - 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change
Published
2024-10-09
Title
UserPlus <= 2.0 - Unauthenticated Privilege Escalation
Published
2026-06-26
Title
AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth