EUVD-2026-103389
GHSA-725w-h4xm-2xw4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public WordPress AJAX endpoint
-
DeliverySend request with absent/invalid nonce
-
ExploitInverted nonce check accepts request
-
ExecutionSupply arbitrary post ID and payload
-
ImpactWrite design data into post metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default installations of the PickPlugins Product Designer for WooCommerce plugin (through 1.0.40). The inverted nonce logic means the request succeeds precisely when the nonce is absent or invalid, so no token harvesting is needed, and no authentication, capability, or user interaction is required. The main factors limiting real-world impact are the bounded effect (attacker can only insert design-template data into post metadata, with no confidentiality or availability impact and no direct code execution) and the requirement that the vulnerable plugin be installed and active on the target WordPress site. |
| Impact | Signals are consistent and point to a genuine but moderate-severity issue rather than a top priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable, remote, unauthenticated flaw with low attack complexity, and CWE-862 (missing authorization) is corroborated by the description's three-fold failure: no capability check, inverted nonce verification, and no validation of the target post. However, impact is bounded - the vector is C:N/I:L/A:N, so this is an integrity-only data-insertion bug (writing design-template data into arbitrary post metadata), not confidentiality loss or code execution, which is why the base score lands at 5.3 (Medium) rather than High/Critical. A public exploit exists (WPScan), raising practical exploitability, but KEV status is NOT listed and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - the presence of POC code should not be conflated with in-the-wild use. Net: a real, easily-triggerable authorization flaw worth patching, but the limited integrity-only impact and lack of KEV/EPSS signals keep it below the tier of urgent, actively-exploited vulnerabilities. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the plugin's AJAX/handler endpoint with a missing or invalid nonce (which the inverted check accepts), supplying an arbitrary post ID and design-template payload. Because no capability check or post validation occurs, the attacker writes attacker-controlled design-template data into the metadata of any post on the site. Publicly available exploit code (WPScan) lowers the barrier to carrying this out at scale. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Unauthenticated attackers can write design-template data into the metadata of arbitrary posts on WordPress sites running the PickPlugins Product Designer for WooCommerce plugin through 1.0.40, because the plugin performs no capability check, inverts its nonce verification, and does not validate the target post ID. Publicly available exploit code exists and remote unauthenticated exploitation works against default installations with no token harvesting or user interaction, though impact is bounded to integrity of post metadata with no confidentiality or availability effect and no direct code execution. EPSS-style risk signals were not provided, and the issue is not reported as part of CISA KEV, so the practical exposure is a moderate-priority data-integrity problem requiring the plugin to be installed and active.
RemediationAI
No vendor-released patch version was identified in the available data, so treat 1.0.40 as the last known affected release and check the WPScan entry (https://wpscan.com/vulnerability/648c7a32-1fc8-44a9-8f52-3aab81a2de55/) and the plugin's WordPress.org listing for a fixed version before upgrading, and if none is published, deactivate and remove the plugin until a fix ships - the most reliable mitigation, at the cost of losing product-designer functionality. Where the plugin must stay active, front the site with a WAF rule that rejects requests to the plugin's design-template save/update handler lacking a valid nonce or carrying unexpected post IDs, accepting that this only narrows the attack surface and can produce false positives for legitimate designer usage; alternatively restrict write access to the affected AJAX/REST endpoints by IP or require an authenticated session at the reverse proxy, which will break any legitimate unauthenticated front-end design flows. Because the vulnerability writes into post metadata, also monitor and periodically audit wp_postmeta for unexpected design-template keys and take a database backup before cleanup so injected metadata can be removed without collateral loss. The public exploit reference means attackers can probe for this quickly, so prioritize inventory checks for the plugin across all WordPress instances.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a WordPress plugin access-control weakness (CWE-862, Missing Authorization) compounded by what amounts to an inverted CSRF guard. Correct WordPress hardening pairs a capability check (current_user_can) with nonce verification (wp_verify_nonce/check_ajax_referer), but this plugin omits the capability check entirely and reverses the nonce branch, so the handler proceeds when the nonce is missing or fails validation and aborts when it is valid - effectively converting the nonce into a no-op for attackers. The handler also fails to confirm that the supplied post identifier is a legitimate write target, so design-template payloads can be attached to the metadata of any post on the site. The affected component is the PickPlugins Product Designer for WooCommerce plugin (CPE record lists an unassigned vendor for the package, versions through 1.0.40 per EUVD). Because the write path lives in post meta rather than in executable templates, the result is stored data manipulation and possible downstream rendering or logic abuse rather than code execution.
Know when Pickplugins Product Designer For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote, unauthenticated, no user interaction due to missing capability check and inverted nonce (AV:N/AC:L/PR:N/UI:N); only arbitrary metadata insertion gives I:L with C:N/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB