CVE-2026-32568: WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is exploitable by a subscriber-level user. It does not require user interaction, and the attack vector is network-accessible.

Q: Which installations are affected?

WooCommerce Designer Pro versions 1.9.33 and earlier are affected. The provided information does not state whether any specific WordPress or WooCommerce configuration is required.

Q: What is the potential impact of successful exploitation?

Successful exploitation can result in remote code execution. The severity data indicates potential high impact to confidentiality, integrity, and availability, with scope change.

Published Oct 6, 2026

Updated

Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.

Affected Software

1 affected component

WordPress WooCommerce Designer Pro<=1.9.33

Event History

Oct 6, 2026

CVE Published

via MITRE·08:33 AM

Data Sourced

via MITRE·08:33 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is exploitable by a subscriber-level user. It does not require user interaction, and the attack vector is network-accessible.

Which installations are affected?

WooCommerce Designer Pro versions 1.9.33 and earlier are affected. The provided information does not state whether any specific WordPress or WooCommerce configuration is required.

What is the potential impact of successful exploitation?