Kadence WooCommerce Email Designer: Critical Privilege Escalation Without Login

Published on 7 August 2026

Picture this: an attacker who has never visited your website before, who holds no username and no password, gains full administrator rights over your online shop with a single crafted request. No employee clicking a link, no stolen credentials – just one network request, and the attacker is sitting in the control centre of your WordPress system. This is exactly the scenario described by the vulnerability CVE-2026-28005 in the widely used plugin Kadence WooCommerce Email Designer.

With a CVSS score of 9.8 out of 10, this security flaw falls into the highest danger category. It affects all plugin versions up to and including 1.5.19 – and a security update is already available. If you run a WooCommerce shop and use this plugin, this article is your to-do list for the next hour.

What happened?

On 23 July 2026, the security researcher “daroo” reported a critical vulnerability in the Kadence WooCommerce Email Designer plugin through the bug bounty programme of the security firm Patchstack. This plugin is used by WooCommerce operators to customise the appearance of their shop's automated emails – such as order confirmations or shipping notifications. It is developed by Nexcess (StellarWP/Liquid Web).

The vulnerability was officially published as CVE-2026-28005 on 6 August 2026 and added to the NIST National Vulnerability Database (NVD) as well as at MITRE. It is what is known as a privilege escalation – an unauthorised elevation of rights. What makes it particularly dangerous: it works without any authentication whatsoever. An attacker needs neither a user account nor any prior knowledge of your system.

The good news up front: the vendor reacted quickly. As early as 28/29 July 2026 – that is, before the CVE was publicly announced – version 1.5.19.1 was released with the terse changelog entry “Stricter checks in the email preview”. The update is available and must be applied urgently.

The technical background – explained clearly

The vulnerability is classified as CWE-862 (Missing Authorization) – a missing authorisation check. What does that mean in practice?

The plugin provides a function that lets you view the shop's email templates live in a preview within the WordPress Customizer interface. Such a function should really check: “Is the person calling up this preview actually authorised?” It was precisely this check that was missing in the affected versions. The endpoint – the interface to which you send a request – accepted commands without verifying the sender's authorisation.

As a result, an attacker could send a specially crafted HTTP request to this preview function and thereby gain administrator rights. The official CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H translates into plain language as follows:

• AV:N (attack over the network): The attack is carried out remotely over the internet.
• AC:L (low complexity): The attack is technically simple to execute.
• PR:N (no privileges required): No login, no account needed.
• UI:N (no user interaction): No one has to click on anything.
• C:H/I:H/A:H: Complete impact on confidentiality, integrity and availability.

In short: the most dangerous combination imaginable. Once exploited successfully, an attacker can gain full control of the WordPress installation. This then opens the door to injecting malware, creating new admin accounts, siphoning off customer data (names, addresses, order histories, and potentially payment data), manipulating the shop, or using your website as a springboard for further attacks.

The patch in version 1.5.19.1 closes the gap by adding the previously missing authorisation check before the affected function is executed.

Who is affected?

Affected are all websites on which the plugin Kadence WooCommerce Email Designer in version 1.5.19 or older is installed and active. According to WordPress.org, the plugin has over 90,000 active installations worldwide; the platform PluginTests.com even cites over 100,000. Since its release in May 2018 it has been downloaded more than 2.24 million times, according to Wordfence Intelligence.

Since WooCommerce is in use on over 7 million WordPress websites and this plugin is specifically dedicated to email design, the vulnerability primarily affects online shop operators – precisely the websites that process a particularly large amount of sensitive personal customer data.

How to check whether you are affected

1. Log in to your WordPress admin dashboard and navigate to Plugins > Installed Plugins.
2. Look in the list for “Kadence WooCommerce Email Designer”. If the plugin is not installed, no action is needed.
3. Check the version number displayed. If it reads 1.5.19 or lower, your installation is vulnerable.
4. Alternatively, you can switch via FTP/SSH to the directory /wp-content/plugins/kadence-woocommerce-email-designer/ and open the file kadence-woocommerce-email-designer.php – the version number is in the plugin header.
5. Check under Dashboard > Updates whether an update to version 1.5.19.1 or higher is available.
6. Under Users > All Users, check whether any unknown administrator accounts exist, and examine your server logs for unusual requests to the email preview function.

What you need to do now

Act immediately. Why the urgency? Because in its annual report “State of WordPress Security in 2026”, Patchstack cites an alarming figure:

“The weighted median time to first exploitation is 5 hours. This suggests that the most heavily attacked vulnerabilities are typically attacked within hours, not days. The first 24 hours are critical when a new exploitable vulnerability is published in the ecosystem.” – Patchstack, State of WordPress Security in 2026

Concretely, these are your steps:

1. Immediate action – apply the update: Update the plugin to version 1.5.19.1 or higher. You can do this in the WordPress admin under Plugins > Installed Plugins or Dashboard > Updates.
2. If an immediate update is not possible: Temporarily deactivate the plugin under Plugins > Installed Plugins by clicking “Deactivate” until you can apply the update.
3. Temporary protection with a WAF: Activate a web application firewall (a protective layer that intercepts malicious requests) with appropriate rules. Patchstack has published a mitigation rule; Wordfence in its free version and similar security plugins also offer protection.
4. Check for compromise: Under Users > All Users (filter: “Administrator”), check for unknown accounts and search your server and access logs for suspicious POST requests to plugin endpoints.
5. Secure preventively: Enable automatic plugin updates or establish a regular update process. A security scanner (e.g. Wordfence or Patchstack) will automatically notify you of new vulnerabilities in the future.

Do not rely solely on classic protection solutions. In tests, Patchstack found: “Traditional defences blocked only 12% of WordPress-specific vulnerability attacks. In a second experiment with an expanded scope, only 26% of the total attacks were blocked.” The update remains the only reliable solution.

Context: a familiar pattern

This vulnerability is not the first in the plugin. Since 2022, a total of six CVEs have been documented – including CVE-2025-54697 (privilege escalation, CVSS 7.2, shop-manager login required, patched in August 2025) and CVE-2025-13387 (stored XSS, CVSS 7.2, December 2025). LocateRisk rates the new flaw as significantly more severe:

“The situation points to a pattern: in August 2025, an earlier vulnerability in the same plugin was patched with CVE-2025-54697. That vulnerability, however, required shop-manager authentication – CVE-2026-28005 is therefore considerably more severe, as it can be exploited without any authentication.” – LocateRisk

At the time of publication (6–7 August 2026), there were no publicly confirmed reports of active exploitation. But Patchstack is unequivocal in its warning:

“This vulnerability is highly dangerous and is expected to be exploited. Vulnerabilities like this are used in mass exploitation campaigns. Attackers use them to attack thousands of websites simultaneously – regardless of their size or prominence.” – Patchstack OÜ

The EPSS score (Exploit Prediction Scoring System), according to Tenable, currently stands at 0.00331 – still a low value, but one that may rise as the vulnerability becomes more widely known. A historical example is a warning against delay: the comparable vulnerability CVE-2023-28121 in WooCommerce Payments (also CVSS 9.8, over 600,000 installations) was actively exploited in mass campaigns within a few days of publication.

The broader context reinforces the urgency: in 2025, 11,334 new vulnerabilities were discovered in the WordPress ecosystem – an increase of 42% over the previous year. Highly exploitable vulnerabilities even rose by 113%. And 91% of all WordPress vulnerabilities are found in plugins, not in the core.

GDPR: Why this is more than an IT problem

For WooCommerce operators in Germany, this vulnerability has an immediate data protection dimension. A successful attack grants full access to all personal data stored in the WordPress database – names, addresses, order histories, and potentially payment data.

Under Art. 33 GDPR, you are obliged to report a personal data breach without delay and, where feasible, within 72 hours of becoming aware of it to the competent data protection supervisory authority (depending on the federal state, e.g. BayLDA, LfDI Baden-Württemberg or LDI NRW) – provided there is a risk to the rights and freedoms of the affected individuals. With full admin access to a shop, this risk is regularly present. Under certain circumstances, Art. 34 GDPR additionally applies, imposing an obligation to notify your customers. Art. 33(5) GDPR further requires you to document every data breach internally.

Equally important: Art. 32 GDPR requires technical and organisational measures (TOMs) that ensure a level of protection appropriate to the risk – this explicitly includes the timely application of security updates. Anyone who fails to patch known critical vulnerabilities risks being assessed as having violated Art. 32 GDPR, which can result in fines under Art. 83 GDPR – up to 10 million euros or 2% of global annual turnover. Companies that fall under the NIS-2 Directive have additional reporting obligations.

Conclusion

CVE-2026-28005 is one of the most dangerous categories of vulnerability there is: unauthenticated privilege escalation with maximum damage potential, combined with about the simplest exploitation imaginable. Over 90,000 installations make the plugin an attractive target for automated mass attacks – and the history of comparable flaws shows that these often occur within hours of publication.

The crucial message is also a reassuring one: a patch exists. Update the plugin Kadence WooCommerce Email Designer to version 1.5.19.1 or higher – now, not at the weekend. If you cannot update immediately, temporarily deactivate the plugin. Then check your administrator accounts and logs for anomalies. And if you find signs of a compromise, remember your 72-hour reporting deadline under Art. 33 GDPR. A well-organised update process and a security scanner will ensure that next time you can react more quickly – before the first hours have elapsed, which in the WordPress ecosystem are so often decisive.