WooCommerce Designer Pro CVE-2026-32568

Requires a valid authenticated WordPress account at Subscriber level or higher (PR:L) on a site running WooCommerce Designer Pro <= 1.9.33; exploitation is most realistic on storefronts that permit open customer self-registration, which is common for WooCommerce. No administrative privileges and no user interaction are required (UI:N). The primary limiting factor is the authentication requirement - sites that disable public registration and have no low-privilege accounts raise the bar, though any compromised or malicious Subscriber still suffices. The exact vulnerable endpoint/feature is not detailed in the available description.

This is a genuine high-priority issue, not merely a high-CVSS paper tiger. The CVSS 9.9 rating is supported by a coherent vector: AV:N/AC:L/PR:L/UI:N/S:C with full C:H/I:H/A:H impact, describing code injection (CWE-94) that an authenticated Subscriber - the lowest WordPress privilege tier, trivially self-registered on many WooCommerce storefronts - can leverage into remote code execution with no user interaction and a scope change onto the host. The effective barrier to entry (a Subscriber account) is very low on a public e-commerce site that allows account registration, which is the common default. Counterbalancing this: no EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or weaponized exploit code at this time - exploitation probability is currently unquantified rather than confirmed low. The sole source is a Patchstack advisory; there is no independent NVD/vendor corroboration in the supplied data. Net: treat as urgent-to-patch for any internet-facing store permitting self-registration, while recognizing that real-world exploitation signals (EPSS/KEV/POC) are simply absent, not negative.

An attacker self-registers (or uses an existing Subscriber account) on a WooCommerce store running the vulnerable plugin, then sends a crafted request to an inadequately-restricted plugin endpoint that injects attacker-controlled code (CWE-94). Because PR:L and UI:N, no admin privileges or victim interaction are needed, and the scope change (S:C) means the injected code executes in the web server context, yielding full host compromise. No public exploit code was identified at time of analysis.