EUVD-2026-89684
GHSA-g7fh-f27c-2hj9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLoad public shortcode page
-
DeliveryScrape nonce and token JS globals
-
ExploitSend crafted 'svg' traversal request
-
ExecutionRead wp-config.php and secrets
-
ImpactExfiltrate database credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target site to have the Product Designer App plugin (≤1.1.3) installed AND to render the [pdapp-studio-page] shortcode on at least one publicly reachable page - that page emits the nonce and token as JavaScript globals, which are the only gate on the vulnerable AJAX endpoint. Given that, exploitation is remote, unauthenticated, and needs no user interaction. The practical limiting factor is that a site without any page publishing the shortcode may not expose the token/nonce to anonymous visitors, narrowing the attack surface; otherwise no special configuration or privileges are needed. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 High) describes a fully remote, unauthenticated, low-complexity arbitrary file read with no user interaction - a genuinely attractive target profile. The description strengthens this: while the endpoint has a nonce/token gate, both values are publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, so the 'authentication' is trivially defeated by an anonymous visitor, fully justifying PR:N. Confidentiality-only impact (I:N/A:N) is consistent with directory traversal reading arbitrary files (e.g. wp-config.php with DB credentials and auth salts). No EPSS score, KEV status, SSVC decision, or POC flag was supplied in the input; per precision rules this is treated as no public exploit identified at time of analysis, and absence of EPSS/KEV should not be read as low risk on its own. This is a real, defensible priority for any site running the plugin because exploitation is unauthenticated and the leaked files can enable full compromise, but it is not confirmed as actively exploited. Net: credible high-value flaw, prioritize patching, but no evidence of mass exploitation yet. |
| Exploit ScenarioDerived | An anonymous attacker loads a public page containing the [pdapp-studio-page] shortcode, scrapes the nonce and token exposed as JavaScript globals, then sends a crafted AJAX request with a path-traversal sequence in the 'svg' parameter (e.g. ../../../../wp-config.php). The server returns the file contents, leaking database credentials and WordPress secret keys. No public exploit code is indicated in the provided data, but the attack requires only a browser and basic request crafting. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated arbitrary file read in the Product Designer App plugin for WordPress (all versions up to and including 1.1.3) lets any remote visitor retrieve the contents of files on the web server through the plugin's 'svg' parameter. The only access control on the vulnerable AJAX endpoint is a nonce and token that the plugin prints as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, so an anonymous attacker who loads such a page can lift those values and pass them along with a crafted traversal path. Per the supplied assessment the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) reflects a fully remote, unauthenticated, low-complexity, no-interaction confidentiality-only flaw; no CISA KEV entry and no public exploit code were identified in the provided data, and no EPSS score was supplied, so exploitation status is assessed as unproven but technically trivial once a shortcode-bearing page exists.
RemediationAI
No vendor-released patch is identified in the provided data, so no fixed version number can be cited; treat the plugin as unfixed at time of analysis and verify current status against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e94db231-e5d4-4b49-ad36-74c0284abfd2?source=cve and the plugin's Trac source at https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/. The single most effective compensating control is to remove the exposure precondition: unpublish or delete every page, post, or template that renders the [pdapp-studio-page] shortcode, which stops the nonce and token from being emitted as JavaScript globals to anonymous visitors and closes the unauthenticated path; the trade-off is that the design/studio page stops functioning for legitimate users. If the plugin is not actively required, deactivate and delete it entirely, which eliminates the vulnerable AJAX action registered in productdesignerapp-front-ajax.php and the file-handling logic in productdesignerapp-helpers.php rather than merely hiding it. As a network-layer stopgap, block unauthenticated POST/GET requests to the plugin's admin-ajax action for the 'svg' handler and filter for traversal sequences (../, ..\, encoded variants such as %2e%2e%2f, and absolute paths) in the 'svg' parameter at the WAF or reverse proxy; be aware that pattern-based filtering is bypassable with encoding tricks and may generate false positives against legitimate SVG filenames, so it should be treated as temporary risk reduction rather than a fix. Additionally, harden the host so that a successful traversal yields less: run PHP under a least-privilege account, restrict filesystem permissions so wp-config.php and backup directories are not world-readable, and disable PHP file operations over remote or unnecessary paths; none of these remove the bug, but they reduce the value of the arbitrary read. Finally, because the impact is disclosure of secrets, rotate any credentials, salts, API keys, or tokens that may reside in files reachable from the web root if there is any indication the endpoint was probed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a third-party WordPress plugin, identified by the CPE cpe:2.3:a:productdesignerapp:product_designer_app:*:*:*:*:*:*:*:* (vendor productdesignerapp, product product_designer_app, version wildcard covering the plugin line). The root cause class is CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): the plugin takes an attacker-controlled 'svg' parameter and uses it in a file path without adequately normalizing or constraining it, so sequences such as ../ can escape the intended plugin/SVG asset directory and reach arbitrary files readable by the PHP process. The referenced code paths illustrate the mechanics: productdesignerapp-front-ajax.php around line 625 registers the AJAX action that consumes the 'svg' parameter, productdesignerapp-helpers.php around line 2867 contains the file-handling logic reachable from that parameter, and productdesignerapp-helpers.php line 261 plus templates/default/script/variants.php line 22 relate to the token/nonce material. Architecturally this is a classic WordPress plugin-auth failure: the endpoint's intended gate is a nonce plus a token, but because the nonce/token pair is emitted as JavaScript globals on the front-end rendering of the [pdapp-studio-page] shortcode, the secret is not a secret at all - any anonymous visitor to that page receives it in the page source. With the CVSS vector showing PR:N and UI:N, the flaw is reachable without credentials and without victim interaction, and with S:U and C:H/I:N/A:N the realistic impact is bulk disclosure of sensitive server-side files (for example wp-config.php, database credentials, API keys, or backup files) rather than code execution or data tampering.
Know when Product Designer App gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Nonce/token are public JS globals so exploitation is effectively unauthenticated (PR:N/AC:L); arbitrary file read yields high confidentiality with no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors.
Executive ViewAI
An unauthenticated file-read vulnerability in the Product Designer App plugin for WordPress (all versions up to and including 1.1.3) lets any anonymous internet visitor retrieve arbitrary files from the web server by loading a page that uses the plugin's [pdapp-studio-page] shortcode. Affected organizations are those hosting customer-facing WordPress sites with this plugin, where exposed configuration files could leak database credentials and API secrets; the issue is rated 7.5 High, confidentiality-only, and requires no authentication or user interaction. No vendor patch is available, and while no public exploit identified at time of analysis, the attack is technically trivial to perform, so leadership should treat every unpatched instance as an open exposure that must be contained now.
No vendor-released patch identified at time of analysis; interim mitigations are to deactivate and remove Product Designer App 1.1.3 and earlier where possible, unpublish or restrict pages using the [pdapp-studio-page] shortcode, block path-traversal payloads in the svg parameter at the WAF or reverse proxy, restrict access to the vulnerable AJAX endpoint and /wp-admin by IP where feasible, and monitor logs for traversal attempts against the plugin.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB