Unauthorized Attachment Deletion Vulnerability in Product Designer Plugin for WordPress

CVE-2024-3608

5.3MEDIUM

Key Information

Vendor: Pickplugins
Status: Product Designer
Vendor: CVE Published:; 9 July 2024

Summary

The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments.

Affected Version(s)

Product Designer <= 1.0.33

CVSS V3.1

Score:

5.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Jul 9, 2024
Disclosed
Jul 8, 2024
Vulnerability Reserved.
Apr 10, 2024

Collectors

NVD DatabaseMitre Database

Credit

Lucio Sá