CVE-2026-32550: WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability
Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Kadence Shop Kitto a version that resolves this vulnerability.Fixed in 3.0.6.1
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is described as subscriber SQL injection, and the CVSS vector lists PR:L. An attacker needs low-privileged authenticated access, such as a subscriber account; no user interaction is required.
Are sites running the plugin's default access model potentially exposed?
Sites are potentially exposed if untrusted users can register for or otherwise obtain subscriber-level accounts and Kadence Shop Kit version 3.0.6 or earlier is installed. The provided data does not identify a required non-default configuration.
What versions need remediation?
Kadence Shop Kit versions 3.0.6 and earlier are affected. The supplied information does not state the first fixed version.