Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-87844: PickPlugins Product Designer lets anyone add data to posts
CVE-2026-87844 · published 17 days ago
Summary
The PickPlugins Product Designer extension for WooCommerce on WordPress does not check who is making changes and accepts requests even when security checks fail. As a result, anyone on the internet can insert unwanted design information into the metadata of any article or product page. Update the plugin to the latest version or remove it if a patch is not available, and restrict access to trusted administrators.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | pickplugins product designer for woocommerce | <= 1.0.40 |
Original advisory text
Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection
The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.3
Medium
Type
CWE-862Missing Authorization
Timeline
Published18 Oct 2026
Updated30 Oct 2026
First seen18 Oct 2026
Track software like this
Free during beta