What is the CVSS score of CVE-2026-28005?

CVE-2026-28005 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Kadence WooCommerce Email Designer are affected by CVE-2026-28005?

The Kadence WooCommerce Email Designer plugin (versions ≤1.5.19) contains a critical privilege escalation vulnerability allowing unauthenticated attackers to gain full administrator access to any…

How to fix or mitigate CVE-2026-28005?

Within 24 hours, identify all WordPress installations using the Kadence WooCommerce Email Designer plugin and immediately disable or remove it; if removal disrupts critical email functionality, isolate affected sites behind additional network access controls. Within 7 days, conduct a security audit of any site where this plugin was active to identify unauthorized administrator accounts or files modified during the plugin's operational period; review all server access and WordPress logs for suspicious activity. Within 30 days, monitor Patchstack and Kadence's official security advisories for a patched release (target version 1.5.20 or later), test thoroughly in a staging environment, and deploy to production only after security validation.

Kadence WooCommerce Email Designer CVE-2026-28005

EUVD-2026-53939 CRITICAL

Missing Authorization (CWE-862)

2026-08-06 Patchstack

GHSA-x6xp-4xjv-q7c6

WordPress Authentication Bypass Privilege Escalation Wordpress Plugin Kadence Woocommerce Email Designer Nexcess

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Missing authorization on a network-reachable WordPress endpoint yields unauthenticated (PR:N), no-interaction, low-complexity privilege escalation with full impact, consistent with the reported 9.8.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:18 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

Articles & Coverage 1

News Critical Privilege Escalation in Kadence WooCommerce Email Designer - CVE-2026-28005 Aug 07, 2026

AnalysisAI

Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.

Technical ContextAI

The affected component is a WordPress plugin (CPE cpe:2.3:a:nexcess:kadence_woocommerce_email_designer) that customizes WooCommerce transactional email templates on sites running WordPress + WooCommerce. The root cause is CWE-862 (Missing Authorization): one or more of the plugin's handlers - typically AJAX actions, REST endpoints, or admin_post/admin-ajax hooks - execute privileged operations without verifying the caller's capability (e.g. current_user_can) or a valid nonce. In WordPress plugins this class of bug commonly lets an unauthenticated request reach functionality intended only for administrators, which in an email-template plugin can include writing arbitrary option/settings values that are subsequently trusted, enabling account or role manipulation. Patchstack's 'Authentication Bypass' tag reinforces that the authorization gate, rather than the underlying feature, is what fails.

RemediationAI

No vendor-released patch version is identified in the provided data; the advisory bounds the vulnerability at ≤1.5.19, so administrators should upgrade to the first vendor release above 1.5.19 as soon as it is published and confirm the fixed build via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/kadence-woocommerce-email-designer/vulnerability/wordpress-kadence-woocommerce-email-designer-plugin-1-5-19-privilege-escalation-vulnerability). Until a fixed version is confirmed and applied, the safest compensating control is to deactivate and remove the plugin, with the trade-off that customized WooCommerce email templates revert to defaults. If removal is unacceptable, deploy a WAF or virtual patch (Patchstack offers one for this CVE) and, where feasible, restrict access to wp-admin/admin-ajax.php and the plugin's REST/AJAX actions at the reverse proxy - noting this may break legitimate front-end AJAX. Additionally monitor for unexpected new administrator accounts or role changes as a detection measure.