CVE-2026-28005 Nexcess CVE debrief

Who should care

Administrators and users of Kadence WooCommerce Email Designer plugin versions <= 1.5.19 should prioritize remediation. This includes reviewing and applying vendor patches, monitoring for suspicious activity, and implementing compensating controls where necessary. Security teams, vulnerability management teams, and operators of affected systems should also be aware of the potential impact and take steps to mitigate the vulnerability.

Technical summary

CVE-2026-28005 is a critical vulnerability (CVSS Score: 9.8) in Kadence WooCommerce Email Designer plugin versions <= 1.5.19, allowing unauthenticated privilege escalation. This vulnerability impacts administrators and users of the plugin, potentially allowing attackers to gain elevated privileges. Affected product deployments should be identified, and defenders should review official advisories and monitor for suspicious activity.

Defensive priority

Immediate attention recommended due to critical severity and potential for unauthenticated privilege escalation.

Recommended defensive actions

• Inventory and version checks for Kadence WooCommerce Email Designer plugin
• Apply vendor remediation or patches if available
• Monitor for suspicious activity
• Implement compensating controls
• Review official advisories for mitigation guidance

Evidence notes

Evidence is limited; primary official records indicate a critical vulnerability in Kadence WooCommerce Email Designer plugin versions <= 1.5.19. Further verification needed. Defenders should verify affected product deployments, review official advisories, and monitor for suspicious activity.

Official resources