WooCommerce Designer Pro: Remote Code Execution (RCE) via Subscriber account

Summary

WooCommerce Designer Pro up to and including version 1.9.33 contains a Remote Code Execution (RCE) flaw (CWE-94). An attacker with a Subscriber-level account can run arbitrary code on the web server without user interaction. The CVSS base score is 9.9 (Critical). Shops that allow open customer registration are most exposed, because attackers can create the required account themselves.

Affected

• WooCommerce Designer Pro (WordPress plugin, package wc-designer-pro) up to and including 1.9.33
• Earliest affected version: unknown (n/a)

Fixed in

Unknown. No fixed version has been confirmed by the vendor or Patchstack at the time of writing.

Workaround

No vendor-sourced workaround is available. Interim measures (analysis, not from a vendor source):

• Deactivate the plugin if the shop does not need its custom design features
• Disable open registration or require manual approval for new Subscriber accounts
• Remove unused accounts and reset passwords of suspicious accounts
• Restrict PHP execution in upload directories

Exploitation

• Not listed as known exploited (CISA KEV: not listed according to a secondary source; KEV catalogue not checked directly)
• No public proof of concept found for this CVE
• CISA SSVC assessment: exploitation none, not automatable, total technical impact
• Patchstack expects exploitation and mass-exploit campaigns, but this is a prediction, not an observed attack
• The plugin had earlier unauthenticated file upload flaws (CVE-2025-6440, public exploit available), which attackers may reuse as techniques

Our recommendation

• Deactivate the plugin if it is not essential; otherwise treat it as high priority
• Disable open customer registration or restrict Subscriber accounts until a fix is confirmed
• Check the Patchstack entry, the plugin changelog on wordpress.org and the vendor site for a fixed version, and update as soon as one is available and tested
• Search the uploads directory and plugin folders for unexpected PHP files and review web server logs for unusual admin-ajax requests
• Monitor the NVD analysis and CISA KEV for changes

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack vulnerability entry CVE-2026-32568 patchstack.com
• CVE record (CVE Program, JSON) raw.githubusercontent.com
• HOL Guard CVE-2026-32568 hol.org
• Strix CVE-2026-32568 www.strix.ai
• OpenCVE CVE-2026-57329 (related plugin CVE) app.opencve.io
• KENET CERT advisory CVE-2025-6440 (earlier plugin CVE) cert.kenet.or.ke

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:41.