CVE Field Guide
About Us
CVE-2026-32568
PUBLISHED
WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability
Assigner:
Patchstack
Reserved:
12.03.2026
Published:
06.10.2026
Updated:
06.10.2026
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
Metrics
CVSS 3.1
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score:
9.9
CVSS score
9.9
Attack Vector
Network
Scope
Changed
Attack Complexity
Low
Confidentiality Impact
High
Privileges Required
Low
Integrity Impact
High
User Interaction
None
Availability Impact
High
CVSS 3.1
Product Status
Vendor
JMAPlugins
Product
WooCommerce Designer Pro
Versions
Default:
unaffected
affected from n/a to 1.9.33 (incl.)
Credits
Nguyen Ba Khanh - HPT Vietnam Corporation | Patchstack Bug Bounty Program
finder
References
https://patchstack.com/database/wordpress/plugin/wc-designer-pro/vulnerability/wordpress-woocommerce-designer-pro-plugin-1-9-33-remote-code-execution-rce-vulnerability?_s_id=cve
Problem Types
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE
Impacts
CAPEC-253 Remote Code Inclusion