5.3
Moyenne
CVE-2024-3608 The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check…
Description
The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments. CVE-2024-38726 appears to be a duplicate of this issue.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Product Designer 1.0 | premières → 1.0.33 | Pas de correctif indiqué |
| product_designer 1.0 | premières → 1.0.33 | Pas de correctif indiqué |
| PickPlugins Product Designer for WooCommerce 1.0 | premières → 1.0.33 | Pas de correctif indiqué |
Autres CVE de Product Designer
Les 4 CVE de Product Designer →
CVE-2024-9111
The Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all…
6.4
Moyenne
CVE-2024-38726
Missing Authorization vulnerability in PickPlugins Product Designer allows Accessing Functionality Not Properly…
7.5
Élevée
CVE-2024-31277
Deserialization of Untrusted Data vulnerability in PickPlugins Product Designer.This issue affects Product Designer:…
8.7
Élevée