The vulnerability CVE-2025-39557 in Kadence WooCommerce Email Designer allows an attacker with high privileges to upload files of dangerous types without restriction. This can include web shells, which may be used to execute arbitrary code on the affected web server. The issue affects all versions up to and including 1.5.14. The CVSS v3.1 base score is 9.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected web server, including unauthorized code execution, data theft, and service disruption. The vulnerability impacts confidentiality, integrity, and availability at a high level. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and limit user privileges to reduce risk. Monitor for suspicious file uploads and consider disabling the plugin if feasible.