This vulnerability in Kadence WooCommerce Email Designer (<= 1.5.16) arises from incorrect privilege assignment, enabling users with some level of access to escalate their privileges improperly. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates that the attack can be performed remotely with low complexity, requires high privileges initially, no user interaction, and results in high impact on confidentiality, integrity, and availability. The issue is publicly disclosed but lacks vendor-provided patch or mitigation details.

Successful exploitation allows an attacker with existing high privileges to escalate their privileges further, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This can result in unauthorized access to sensitive data and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual privilege escalations. Avoid granting unnecessary high privileges to users in environments using affected versions.