Unauthorized Access Vulnerability in Fancy Product Designer Plugin for WordPress

CVE-2021-4335

Summary

The Fancy Product Designer plugin for WordPress contains a vulnerability that allows authenticated attackers with subscriber-level permissions to perform unauthorized actions. Due to inadequate capability checks on several AJAX functions, these attackers can modify plugin settings and access sensitive information. This includes the ability to retrieve arbitrary order details and create, update, or delete products and orders that do not belong to them. Versions up to and including 4.6.9 are affected, raising significant security concerns for site administrators relying on this plugin.

References