What is the CVSS score of EUVD-2026-75525?

EUVD-2026-75525 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Shirt Product Designer are affected by EUVD-2026-75525?

The Shirt Product Designer for WooCommerce plugin (v1.0.4) contains a broken access control vulnerability that allows unauthenticated remote attackers to modify store product and configuration data…

How to fix or mitigate EUVD-2026-75525?

Within 24 hours, inventory all WordPress installations running Shirt Product Designer for WooCommerce version 1.0.4 and deactivate the plugin immediately if operationally feasible to eliminate the attack surface entirely. Within 7 days, monitor Patchstack and the plugin vendor's channels for patch availability, evaluate functionally equivalent alternative plugins, and implement Web Application Firewall (WAF) rules or network-level access controls to restrict unauthorized requests to product modification endpoints if the plugin cannot be removed. Within 30 days, apply the vendor-released patch as soon as one becomes available, or execute a permanent migration to an alternative plugin solution with confirmed security controls; in either case, implement persistent database integrity monitoring and comprehensive audit logging to detect and alert on any unauthorized product data modifications.

Shirt Product Designer EUVD-2026-75525

| CVE-2026-81794 HIGH

Missing Authorization (CWE-862)

2026-09-10 Patchstack

GHSA-2xwm-9r7v-cv99

WordPress Wordpress Plugin Mlfactory Shirt Product Designer For Woocommerce

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-reachable plugin endpoint, no credentials required, integrity-only impact with no confidentiality or availability effect confirmed by description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 10, 2026 - 15:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 10, 2026 - 15:13 vuln.today

CVE Published

Sep 10, 2026 - 14:23 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.

AnalysisAI

Broken access control in Shirt Product Designer for WooCommerce plugin version 1.0.4 exposes WordPress/WooCommerce stores to unauthenticated data modification. The CVSS vector (PR:N, AC:L, AV:N, UI:N) confirms that a remote attacker with no credentials or user interaction can invoke privileged plugin functionality, achieving high integrity impact against store product or configuration data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No authentication or special privileges are required - the CVSS vector (PR:N, AC:L, AV:N, UI:N) confirms exploitation is possible by any unauthenticated remote attacker reaching the WordPress site over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) classifies this as a low-complexity, remotely exploitable authorization flaw requiring no credentials and no interaction from a victim. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woo-shirt-product-designer/vulnerability/wordpress-shirt-product-designer-for-woocommerce-plugin-1-0-4-broken-access-control-vulnerability for the latest patch status from mlfactory; no exact fixed version is confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WordPress installations running Shirt Product Designer for WooCommerce version 1.0.4 and deactivate the plugin immediately if operationally feasible to eliminate the attack surface entirely. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wordpress Plugin

View all

CVE-2023-6553 CRITICAL Act Now POC

9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-5084 CRITICAL Act Now POC

9.8 May 23

The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil

CVE-2024-44000 CRITICAL Emergency POC

9.8 Oct 20

Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote

CVE-2020-36847 CRITICAL Act Now POC

9.8 Jul 12

The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner

CVE-2025-27007 CRITICAL Emergency POC

9.8 May 01

The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut

CVE-2016-1209 CRITICAL Emergency POC

9.8 May 14

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via

CVE-2024-4443 CRITICAL Act Now POC

9.8 May 22

The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based

CVE-2024-1698 CRITICAL Act Now POC

9.8 Feb 27

SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a

CVE-2023-6875 CRITICAL Emergency POC

9.8 Jan 11

The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i

CVE-2024-1512 CRITICAL Emergency POC

9.8 Feb 17

The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base

CVE-2024-4295 CRITICAL Act Now POC

9.8 Jun 05

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in

CVE-2024-50498 CRITICAL Emergency POC

10.0 Oct 28

Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u

Same weakness CWE-862 – Missing Authorization

View all

CVE-2023-52163 HIGH POC

8.8

CVE-2025-6205 CRITICAL POC

9.1

CVE-2025-20362 HIGH POC

8.6

CVE-2017-9232 CRITICAL POC

9.8

CVE-2023-6875 CRITICAL POC

9.8

CVE-2024-4898 CRITICAL POC

9.8

CVE-2023-32117 CRITICAL POC

9.8

CVE-2020-36719 CRITICAL POC

9.8

EUVD-2026-75525 vulnerability details – vuln.today

Back

Shirt Product Designer EUVD-2026-75525

Severity by source

CVSS VectorVendor: Patchstack

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Wordpress Plugin

Same weakness CWE-862 – Missing Authorization

Share

External POC / Exploit Code