CVE-2026-94677

HighCVSS 7.2

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The Kadence WooCommerce Email Designer plugin in versions up to and including 1.5.19.1 contains a PHP Object Injection vulnerability exploitable by a Shop manager-level user. This enables injection of a malicious PHP object.

Risk Assessment

An attacker with Shop manager privileges can inject a malicious PHP object, potentially leading to remote code execution or other severe consequences.

Recommendation

Update the Kadence WooCommerce Email Designer plugin to a version newer than 1.5.19.1.

Other vulnerabilities in Kadence WooCommerce Email Designer

CVE-2026-28005Critical
Unauthenticated Privilege Escalation vulnerability in Kadence WooCommerce Email Designer versions up to 1.5.19.

Original NVD description (English source)

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS