Kadence Shop Kit EUVD-2026-66989

Authentication as a WordPress subscriber (the lowest registered-user role, PR:L per CVSS vector) is required; unauthenticated exploitation is not supported by the available data. The Kadence Shop Kit plugin must be installed and active on the target WordPress instance running WooCommerce. No additional non-default configuration is indicated as a prerequisite. Sites with disabled user registration limit the attacker's ability to self-provision an account, but existing subscriber accounts (customers, newsletter subscribers) remain a viable vector. The CVSS AC:L metric confirms no race condition, special timing, or environmental prerequisites apply once authenticated access is obtained.

The CVSS base score of 8.5 reflects a high-severity finding driven primarily by network accessibility (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), changed scope (S:C), and high confidentiality impact (C:H). The PR:L requirement is the principal limiting factor: an attacker must possess at minimum a subscriber account on the target site, which on sites with open user registration is trivially obtainable. EPSS data is not present in the provided intelligence, so exploitation probability cannot be quantified; however, the low technical barrier - subscriber access plus a crafted HTTP request - makes this class of vulnerability highly attractive for opportunistic attackers. KEV status is not confirmed, and no POC code is noted, meaning current exploitation evidence is absent rather than ruled out. The S:C and C:H combination means successful exploitation can expose not only WordPress-native data (user PII, credentials, order records) but potentially data from co-located database schemas. Real-world risk is meaningfully higher on sites with open registration or in shared hosting environments where the MySQL user has broad cross-schema privileges, and any organization with subscriber-accessible WooCommerce stores should treat remediation as urgent regardless of absolute traffic volume.

An attacker registers a free subscriber account on a target WordPress site running Kadence Shop Kit 3.0.6 or older, or reuses previously obtained subscriber credentials. The attacker then crafts an HTTP request to the vulnerable plugin endpoint, embedding SQL injection syntax in a parameter that is passed unsanitized to the database layer. No public exploit code is confirmed at time of analysis, but the standard attack technique for PR:L/AC:L SQL injection is well within the reach of script-level attackers using tools such as sqlmap with session cookie authentication.