CVE-2026-94677: WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Kadence WooCommerce Email Designerto a version that resolves this vulnerability.Fixed in 1.5.19.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs Shop Manager privileges in WordPress. The vulnerability is not described as exploitable by unauthenticated users or lower-privileged accounts.
Which installations are affected?
Kadence WooCommerce Email Designer versions up to and including 1.5.19.1 are affected. The available data does not state whether any particular default configuration or feature setting is required.
What is the potential impact if exploited?
The reported CVSS vector rates confidentiality, integrity, and availability impacts as high. Successful exploitation involves PHP object injection by a Shop Manager-level user.