Kadence WooCommerce Bug: Stop Admin Takeover

If you run Kadence WooCommerce Email Designer on your WordPress store, update to the latest version immediately to prevent unauthorized visitors from granting themselves full administrator accounts.

This guide is for WooCommerce store owners, WordPress administrators, and e-commerce managers who need clear facts on CVE-2026-28005. You will learn how this vulnerability works, whether your store is exposed, the exact steps to apply the WordPress plugin privilege escalation fix, and how to verify that no intruder created an unauthorized administrator account on your site.

What is CVE-2026-28005 and why is it critical?

On August 6, 2026, security researchers disclosed a critical vulnerability designated as CVE-2026-28005 in the Kadence WooCommerce Email Designer plugin. It received a maximum-tier CVSS 3.1 score of 9.8 out of 10.0, placing it in the Critical severity band.

In technical catalogs, the flaw is classified under CWE-862: Missing Authorization and documented in the Patchstack vulnerability database. In plain English, missing authorization means the software accepts a command from the web without checking who sent it or whether that person has administrative permissions.

The CVSS 9.8 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) breaks down into severe real-world risk:

• Network reachable (AV:N): The flaw can be exploited remotely across the web without physical or local network access.
• Low complexity (AC:L): Exploitation does not require special conditions or timing tricks.
• No privileges required (PR:N): An anonymous visitor with zero credentials can launch the attack.
• No user interaction (UI:N): No administrator needs to click a link or open an email for the exploit to work.
• High impact (C:H/I:H/A:H): A successful attack gives the intruder total control over confidentiality, data integrity, and store availability.

When an unauthenticated visitor can grant themselves administrative privileges, your entire business is exposed. They can view customer records, export order histories containing personal information, alter checkout settings, or install malicious scripts.

Who is affected? Check your plugin version right now

According to the official vulnerability description, this Kadence WooCommerce Email Designer vulnerability affects all versions up to and including 1.5.19 (versions <= 1.5.19). If your store runs version 1.5.19 or any earlier release, your site is vulnerable until you update or deactivate the plugin.

You can verify your current version number in under two minutes:

Option 1: Check via the WordPress dashboard

1. Log into your WordPress administrative panel.
2. In the left navigation menu, click Plugins > Installed Plugins.
3. Scroll down to Kadence WooCommerce Email Designer.
4. Check the version number printed directly beneath the plugin name.

Option 2: Check via WP-CLI

If you manage your server through SSH or use WP-CLI, run:

wp plugin get kadence-woocommerce-email-designer --field=version

If your installed version is 1.5.19 or lower, take immediate action. Use this table to assess your store:

How unauthenticated admin takeover happens in WooCommerce

To defend your store effectively, it helps to understand what happens behind the scenes. Kadence WooCommerce Email Designer is a popular tool used to customize transactional emails, such as order receipts and shipping updates.

To allow customization, plugins register internal endpoints. In WordPress, plugins handle server requests using AJAX actions or the WordPress REST API:

• Authenticated actions (wp_ajax_*): These run only when a logged-in user with valid session cookies makes a request.
• Public actions (wp_ajax_nopriv_*): These run for anyone visiting your website, such as guest shoppers adding items to a cart.

In flaws classified as CWE-862, an endpoint that executes sensitive administrative operations is accidentally exposed without checking user capabilities. A secure plugin verifies permissions on every administrative request using current_user_can('manage_options') and validates a cryptographic token known as a nonce.

When those checks are omitted, any anonymous web client can send an HTTP POST request directly to the endpoint. In an unauthenticated admin takeover WooCommerce scenario, automated bot scanners sweep through thousands of WordPress websites. When a bot discovers an unpatched store running Kadence WooCommerce Email Designer, it sends a payload that triggers the unprotected internal function, creating a new user account with the Administrator role or elevating an existing guest record.

Once the attacker holds administrator rights, they have full control over your store without needing your hosting or cPanel credentials. From your dashboard, an intruder can:

• Read customer names, shipping addresses, phone numbers, and purchase histories.
• Install rogue plugins or upload web shells to execute arbitrary code on your server.
• Inject malicious JavaScript skimming scripts into WooCommerce checkout pages to capture credit card numbers in real time.
• Lock out legitimate administrator accounts by changing email addresses and resetting passwords.

Step-by-step: WordPress plugin privilege escalation fix

Resolving this vulnerability requires applying the vendor's patched version or temporarily disabling the vulnerable code. Follow these practical steps to protect your store.

Step 1: Update through the WordPress dashboard

The fastest path for most store owners is the standard dashboard updater:

1. Log into your WordPress administrative panel (/wp-admin).
2. Navigate to Dashboard > Updates, or go directly to Plugins > Installed Plugins.
3. Locate Kadence WooCommerce Email Designer in the list.
4. If an update banner is visible, click Update Now.
5. Wait for the confirmation message indicating the update was completed successfully.
6. Check the official vendor changelog on WordPress.org to verify you are running the newest available release.

Step 2: Update using WP-CLI

If you operate an agency, manage multiple client stores, or prefer the command line, run this command in your site directory:

wp plugin update kadence-woocommerce-email-designer

Once the update finishes, confirm that the plugin is running the latest version:

wp plugin get kadence-woocommerce-email-designer

Step 3: Emergency mitigation if you cannot update immediately

If you cannot update immediately due to frozen deployment cycles or custom code conflicts, deactivate the plugin right now:

1. Go to Plugins > Installed Plugins.
2. Find Kadence WooCommerce Email Designer and click Deactivate.

Many store owners hesitate to deactivate email designer plugins out of fear that customer transactional emails will stop sending. Fortunately, WooCommerce includes built-in native email templates. When Kadence WooCommerce Email Designer is deactivated, your store does not stop sending order confirmations, shipping updates, or customer receipts. Instead, WooCommerce simply falls back to its default clean styling. Your customers will still receive every notification, and your store will be safe from remote exploitation while you prepare your update.

Post-patch audit: Did anyone exploit this on your store?

Updating your plugin closes the door on future attacks, but it does not remove an intruder who may have slipped in before you updated. Because CVE-2026-28005 allows unauthenticated account creation, automated bots may scan for vulnerable sites and exploit them silently.

Perform this 4-step post-patch audit to ensure your store remains clean:

1. Inspect all administrator accounts

Your first priority is verifying that every administrator account on your site belongs to someone you trust:

1. In your WordPress dashboard, go to Users > All Users.
2. Click the Administrator link at the top of the table to filter exclusively by admin users.
3. Review every user listed. Check the username, display name, and email address.
4. Look for red flags:

• Random string usernames like adm_8812 or sec_test.
• Unfamiliar names or burner email addresses using domains like tempmail, .top, .ru, or suspicious free webmail providers.
• Legitimate usernames with altered email addresses that redirect password resets to an external inbox.

If you manage your site via WP-CLI, list all administrators and their registration dates with:

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

2. Inspect your installed plugins and mu-plugins

When an attacker gains admin access, they often install a secondary backdoor so they can regain entry even if the primary vulnerability is patched:

• Check Plugins > Installed Plugins for tools you never installed, such as unauthorized file managers or database editors.
• Check your wp-content/mu-plugins/ (must-use plugins) folder via FTP or your hosting control panel. Must-use plugins execute automatically on every page load and do not show up in the standard WordPress plugin list. If that directory contains unfamiliar PHP files, investigate them immediately.

3. Verify file integrity with checksums

WordPress core and official repository plugins provide digital signatures called checksums. You can verify that your core files and plugins match the official versions hosted on WordPress.org:

# Verify WordPress core files
wp core verify-checksums

# Verify installed repository plugins
wp plugin verify-checksums --all

If any file returns a warning indicating that its contents were modified, examine the file to determine whether malicious code was injected.

4. What to do if you find evidence of compromise

If you identify an unauthorized administrator account or rogue code on your store:

1. Immediately delete the rogue user account from Users > All Users. When prompted, delete all posts created by that user or reassign them to your verified primary account.
2. Reset passwords for all remaining administrative accounts and enforce two-factor authentication (2FA).
3. Invalidate all active user sessions by updating the security keys and salts in your wp-config.php file.
4. Follow our detailed step-by-step checklist on what to do when your website is hacked to isolate your server, check database tables, and clean compromised files safely.

Why automated security scans miss plugin logic flaws

A frequent question store owners ask after a vulnerability disclosure is: "Why didn't my hosting scanner or free plugin scanner catch this earlier?"

Most automated scanners operate by reading public HTML, checking HTTP response headers, or matching version banners against public vulnerability lists. If a vulnerability is brand new, or if the scanner only checks whether your homepage loads over HTTPS, it will not discover that an internal plugin function lacks authorization checks.

Automated scanners struggle with application logic. A scanner does not know what your specific WooCommerce plugins do when custom arguments are sent to an internal endpoint. It cannot tell whether an administrative function should be restricted to store owners or if it was intentionally exposed for guest checkouts.

This gap is why understanding manual vs automated penetration testing is so relevant for e-commerce. Automated tools are helpful for rapid baseline checks, but identifying whether custom endpoints, checkout flows, and plugin hooks enforce proper permissions requires human analysis. A human security auditor looks at how your specific plugins interact, tests input validation manually, and ensures that sensitive privileges cannot be seized by unauthenticated visitors.

If you want to check your site's external security headers and email protections right now, you can run our free website security check for an immediate passive analysis of your store's perimeter.

Key takeaways

• Critical severity: CVE-2026-28005 carries a CVSS 9.8 score and allows unauthenticated remote attackers to gain full administrative rights on affected WooCommerce sites.
• Affected versions: All versions of Kadence WooCommerce Email Designer up to and including version 1.5.19 are vulnerable.
• Update immediately: Update to the latest release through your WordPress dashboard or WP-CLI to protect your store from automated exploit scripts.
• Safe temporary fallback: If you cannot update immediately, deactivate the plugin; WooCommerce will safely deliver all transactional emails using its built-in default templates.
• Audit your user list: After patching, check Users > All Users for unrecognized administrator accounts to confirm your store was not targeted prior to updating.

Need a human engineer to verify your store?

Automated scanners can tell you which plugin versions are outdated, but they cannot tell you whether a backdoor was left behind in your database or whether custom code left your checkout open to data theft.

Bug Circuit provides productized, manual website security reviews for small businesses and e-commerce stores. Through our Circuit service ($49 one-time), an experienced application security engineer manually audits your website, inspects your configuration, and delivers a clear written report detailing every issue found, complete with severity ratings, reproducible evidence, and exact code fixes.

No expensive recurring retainers, no confusing jargon, and no automated fluff. Just an honest human check to give you peace of mind. Check our manual audit pricing to secure your store today.