5.3
Medium
CVE-2024-3608 The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check…
Description
The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments. CVE-2024-38726 appears to be a duplicate of this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Product Designer 1.0 | earliest → 1.0.33 | No fix stated |
| product_designer 1.0 | earliest → 1.0.33 | No fix stated |
| PickPlugins Product Designer for WooCommerce 1.0 | earliest → 1.0.33 | No fix stated |
Other CVEs of Product Designer
The 4 CVEs of Product Designer →
CVE-2024-9111
The Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all…
6.4
Medium
CVE-2024-38726
Missing Authorization vulnerability in PickPlugins Product Designer allows Accessing Functionality Not Properly…
7.5
High
CVE-2024-31277
Deserialization of Untrusted Data vulnerability in PickPlugins Product Designer.This issue affects Product Designer:…
8.7
High