CVE-2026-32568: WooCommerce Designer Pro RCE Vulnerability

CVE-2026-32568 Overview

CVE-2026-32568 is a code injection vulnerability in the WooCommerce Designer Pro WordPress plugin affecting versions 1.9.33 and earlier. Authenticated users with Subscriber-level privileges can achieve Remote Code Execution (RCE) on the underlying web server. The flaw is classified under CWE-94: Improper Control of Generation of Code and allows an attacker to execute arbitrary PHP in the context of the WordPress process. Because Subscriber accounts can be created on many WooCommerce storefronts through standard registration, the barrier to exploitation is low.

Critical Impact
An authenticated Subscriber can execute arbitrary code on the WordPress host, resulting in full site compromise, data theft, and lateral movement into connected systems.

Affected Products

WooCommerce Designer Pro plugin for WordPress
All versions up to and including 1.9.33
WordPress sites running WooCommerce with the Designer Pro extension enabled

Discovery Timeline

2026-10-06 - CVE-2026-32568 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-32568

Vulnerability Analysis

The vulnerability is a code injection weakness (CWE-94) in the WooCommerce Designer Pro plugin. An attacker holding a Subscriber account—the lowest WordPress privilege tier—can reach a plugin code path that evaluates attacker-controlled input as executable code. Successful exploitation yields arbitrary command execution with the privileges of the PHP worker process, typically www-data or an equivalent service account. The scope is marked as changed in the CVSS vector, reflecting that the compromise extends beyond the plugin's own security authority to the entire WordPress installation and host.

Root Cause

The plugin exposes functionality that passes untrusted request data into a sink capable of generating or executing PHP code without adequate sanitization or capability checks. Because the endpoint is reachable by low-privileged authenticated users, standard administrative gating is absent. See the Patchstack RCE Vulnerability Report for additional technical context.

Attack Vector

Exploitation requires only a valid Subscriber account and network access to the WordPress site. The attacker authenticates, then issues a crafted HTTP request to the vulnerable plugin endpoint. The payload is interpreted as PHP, giving the attacker a web shell, the ability to drop malware, pivot to the database, or exfiltrate customer and order data from the WooCommerce store.

No verified public exploit code is available at the time of writing. Refer to the Patchstack advisory for additional details.

Detection Methods for CVE-2026-32568

Indicators of Compromise

Unexpected PHP files written under wp-content/plugins/wc-designer-pro/ or wp-content/uploads/
Outbound connections from the web server to unknown hosts shortly after Subscriber authentication events
New administrator accounts, modified wp-config.php, or scheduled tasks (wp_cron) referencing unknown callbacks
Access log entries showing authenticated POST requests to WooCommerce Designer Pro AJAX or REST endpoints from newly registered Subscriber accounts

Detection Strategies

Review web server access logs for POST requests to plugin endpoints paired with HTTP 200 responses and anomalous payload sizes
Correlate recent Subscriber-level account registrations with activity against wc-designer-pro routes
Monitor WordPress audit logs for file writes, plugin modifications, and user role escalations

Monitoring Recommendations

Enable file integrity monitoring across the wp-content/ directory tree, with alerting on .php file creation
Capture and retain WordPress authentication and REST API telemetry in a centralized log store for retrospective hunts
Alert on process execution anomalies spawned by the PHP-FPM or Apache worker, such as sh, bash, curl, or wget

How to Mitigate CVE-2026-32568

Immediate Actions Required

Disable or remove the WooCommerce Designer Pro plugin on all affected sites until a vendor patch is applied
Audit WordPress user accounts and remove unknown Subscriber registrations created in the recent past
Rotate WordPress administrator credentials, API keys, and database passwords after confirming the host is clean
Review file systems for web shells and unauthorized plugin or theme modifications

Patch Information

At the time of publication, no fixed version is listed in the NVD record for CVE-2026-32568. Monitor the Patchstack advisory and the WooCommerce Designer Pro vendor channel for a release above 1.9.33 that addresses the code injection path.

Workarounds

Disable open user registration (Settings → General → Membership) to prevent attackers from self-provisioning Subscriber accounts
Deploy a Web Application Firewall rule to block requests to WooCommerce Designer Pro endpoints originating from non-administrator sessions
Restrict write permissions on wp-content/ and plugin directories so the web server cannot create new PHP files at runtime

bash

# Temporarily disable the plugin via WP-CLI until a patched release is available
wp plugin deactivate wc-designer-pro
wp plugin status wc-designer-pro

# Disable open registration site-wide
wp option update users_can_register 0