CVE-2026-28005: Critical Privilege Escalation in Kadence WooCommerce Email Designer

Executive Summary

A critical unauthenticated privilege escalation vulnerability (CVE-2026-28005) has been disclosed in the Kadence WooCommerce Email Designer WordPress plugin. The flaw carries a CVSS score of 9.8 and affects all versions up to and including 1.5.19. An unauthenticated attacker can exploit this vulnerability to escalate their privileges on the target WordPress site — up to and including administrator access — without providing any valid credentials.

CVSS Score: 9.8 (Critical)

The plugin is used by WordPress and WooCommerce site owners to customize the design, layout, and content of WooCommerce transactional emails. With over 100,000 active installations, the exposure window for this vulnerability is substantial.

Vulnerability Overview

Affected Versions

Technical Background

Privilege escalation vulnerabilities in WordPress plugins typically stem from improperly secured AJAX endpoints or REST API routes that lack both nonce validation and capability checks. When a plugin registers a handler for an action like wp_ajax_nopriv_* (accessible to unauthenticated users), a missing capability check allows any visitor to trigger functionality that should be restricted to administrators.

In this class of vulnerability, the attack flow generally works as follows:

1. Attacker identifies WordPress site running vulnerable Kadence plugin
2. Attacker sends crafted HTTP POST to wp-admin/admin-ajax.php
   (targeting an unauthenticated action hook)
3. Plugin processes the request without verifying caller permissions
4. Attacker's supplied role/user data is applied server-side
5. Attacker account elevated to Administrator — or new admin account created
6. Full site takeover: content manipulation, credential harvesting, malware install

Why CVSS 9.8?

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update the Plugin

Update Kadence WooCommerce Email Designer to the latest version immediately. Updates are available through the WordPress admin panel.

# Via WP-CLI
wp plugin update kadence-woocommerce-email-designer
 
# Confirm installed version
wp plugin get kadence-woocommerce-email-designer --field=version

Or via WordPress Admin → Plugins → Installed Plugins → Kadence WooCommerce Email Designer → Update Now.

Step 2: Audit for Compromise

If the plugin was running an affected version on a publicly accessible site, assume potential compromise and investigate:

# Check for recently created admin accounts
wp user list --role=administrator --fields=ID,user_login,user_registered
 
# Scan for unexpected PHP files in uploads
find /path/to/wordpress/wp-content/uploads/ -name "*.php" -type f
 
# Check recently modified plugin/theme files
find /path/to/wordpress/wp-content/ -name "*.php" \
  -newer /path/to/wordpress/wp-includes/version.php -type f
 
# Verify core WordPress integrity
wp core verify-checksums

Step 3: Review User Accounts

# List all administrators and when they registered
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
 
# Remove any unauthorized admin accounts
wp user delete <suspicious-user-id> --reassign=<admin-user-id>

Step 4: Rotate Credentials

1. Rotate all WordPress admin passwords
2. Regenerate WordPress secret keys and salts:

   wp config shuffle-salts

   Copy

3. Rotate WooCommerce payment gateway API keys if stored in the database
4. Rotate any credentials stored in wp-config.php

If Immediate Patching Is Not Possible

1. Deactivate the plugin entirely until the patch can be applied
2. Block access to wp-admin/admin-ajax.php at the WAF or web server level for unauthenticated requests (where feasible without breaking site functionality)
3. Enable a virtual patch through Patchstack or Wordfence if available
4. Monitor access logs for unexpected POST requests to AJAX endpoints

Detection Indicators

Post-Remediation Steps

1. Confirm plugin is updated to the patched version
2. Remove any unauthorized admin accounts created during the exposure window
3. Rotate all administrative credentials
4. Scan the full WordPress installation for webshells and unauthorized modifications
5. Review WooCommerce order and customer data for unauthorized access indicators
6. Deploy a Web Application Firewall (Wordfence, Patchstack, Sucuri)
7. Enable WordPress file integrity monitoring
8. Consider subscribing to vulnerability alerts for all installed plugins

References

• NIST NVD — CVE-2026-28005
• Patchstack — Kadence WooCommerce Email Designer Vulnerabilities
• Wordfence Intelligence — Kadence WooCommerce Email Designer

Related Reading

• CVE-2026-28139: PHP Object Injection in Ajax Search Lite
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• WordPress Plugin Vulnerability (CVSS 10.0) Under Active Exploitation