CVE-2026-32568
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: Patchstack

Description
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-19
AI Q&A
2026-10-06
EPSS Evaluated
2026-10-18
NVD
CVE-2026-32568
EUVD
EUVD-2026-93231

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
JMAPlugins WooCommerce Designer Pro n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical Remote Code Execution (RCE) vulnerability in the WooCommerce Designer Pro plugin for WordPress, affecting versions 1.9.33 and below. It allows attackers with Subscriber-level access to execute arbitrary commands on the server remotely. The flaw is classified under OWASP Top 10 A3: Injection and has a CVSS score of 9.9, indicating high severity.

Detection Guidance

Detecting this RCE vulnerability requires checking if the WooCommerce Designer Pro plugin version 1.9.33 or below is installed. Inspect WordPress plugin files for suspicious code or unauthorized command execution attempts. Review server logs for unusual activity from subscriber-level accounts.

Impact Analysis

This vulnerability can lead to complete server compromise, allowing attackers to take full control of the affected WordPress site. It poses risks of data theft, malware injection, or unauthorized modifications. Since no official patch exists, attackers may exploit it widely until a fix is released.

Compliance Impact

This RCE vulnerability can lead to unauthorized access and data breaches, violating GDPR and HIPAA compliance requirements. It may result in legal penalties, reputational damage, and loss of customer trust due to compromised sensitive data.

Mitigation Strategies

Immediately disable the WooCommerce Designer Pro plugin if installed. Apply Patchstack's temporary mitigation rule if available. Contact your hosting provider or developer for further assistance as no official patch exists yet.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32568. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart