Product Designer App
Monthly
Unauthenticated arbitrary file read in the Product Designer App plugin for WordPress (all versions up to and including 1.1.3) lets any remote visitor retrieve the contents of files on the web server through the plugin's 'svg' parameter. The only access control on the vulnerable AJAX endpoint is a nonce and token that the plugin prints as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, so an anonymous attacker who loads such a page can lift those values and pass them along with a crafted traversal path. Per the supplied assessment the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) reflects a fully remote, unauthenticated, low-complexity, no-interaction confidentiality-only flaw; no CISA KEV entry and no public exploit code were identified in the provided data, and no EPSS score was supplied, so exploitation status is assessed as unproven but technically trivial once a shortcode-bearing page exists.
Unauthenticated arbitrary file read in the Product Designer App plugin for WordPress (all versions up to and including 1.1.3) lets any remote visitor retrieve the contents of files on the web server through the plugin's 'svg' parameter. The only access control on the vulnerable AJAX endpoint is a nonce and token that the plugin prints as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, so an anonymous attacker who loads such a page can lift those values and pass them along with a crafted traversal path. Per the supplied assessment the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) reflects a fully remote, unauthenticated, low-complexity, no-interaction confidentiality-only flaw; no CISA KEV entry and no public exploit code were identified in the provided data, and no EPSS score was supplied, so exploitation status is assessed as unproven but technically trivial once a shortcode-bearing page exists.