This vulnerability (CVE-2026-28005) in Kadence WooCommerce Email Designer (<=1.5.19) is classified as CWE-862: Missing Authorization. It permits unauthenticated privilege escalation, meaning attackers can gain elevated permissions without proper authentication or authorization controls. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not provided an official fix or remediation level, and no patch links are available. The product is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows unauthenticated attackers to escalate privileges, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could enable attackers to manipulate email templates or other sensitive configurations within WooCommerce Email Designer, impacting business operations and customer communications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor vendor communications for updates. Until a patch is available, restricting access to the affected plugin and limiting exposure may reduce risk.