CVE-2026-32568: CWE-94 Improper Control of Generation of Code ('Code Injection') in JMAPlugins WooCommerce Designer Pro

This vulnerability (CVE-2026-32568) affects WooCommerce Designer Pro by JMAPlugins, allowing an attacker with subscriber privileges to execute arbitrary code remotely. The root cause is improper control over code generation, classified under CWE-94 (Code Injection). The CVSS 3.1 score of 9.9 reflects network attack vector, low attack complexity, required privileges at the subscriber level, no user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation can lead to remote code execution with subscriber-level privileges, potentially compromising the entire system, including full confidentiality, integrity, and availability of the affected environment. This represents a critical security risk for affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access and monitor for suspicious activity related to WooCommerce Designer Pro. Avoid deploying this plugin in sensitive environments until patched.