Directory Traversal Vulnerability in Product Designer App for WordPress

CVE-2026-75098

What is CVE-2026-75098?

The Product Designer App for WordPress is prone to a directory traversal vulnerability, affecting all versions up to and including 1.1.3. Exploitation of this flaw allows unauthenticated users to access and read arbitrary files on the server through the 'svg' parameter. This is facilitated by insufficient authentication mechanisms, where both nonce and token are exposed as JavaScript globals on any page that renders the [pdapp-studio-page] shortcode, making them easily accessible by malicious actors. As a result, sensitive information stored on the server may be compromised.

References