CVE-2026-87844
Received Received - Intake

Unauthenticated Post Metadata Injection in PickPlugins Product Designer for WooCommerce

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: WPScan

Description
The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-87844
EUVD
EUVD-2026-103389

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown PickPlugins Product Designer for WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WordPress plugin Product Designer up to version 1.0.40. It allows unauthenticated users to inject design template data into any post's metadata due to missing capability checks, inverted nonce verification, and lack of post validation.

Detection Guidance

Check if the WordPress plugin 'Product Designer' is installed and its version is 1.0.40 or lower. Look for unauthorized changes in post metadata or design template data injections. Monitor for unusual activity from unauthenticated users.

Impact Analysis

An attacker could modify post metadata to include malicious design templates, potentially defacing the site or injecting harmful content without needing user credentials.

Compliance Impact

This vulnerability allows unauthenticated users to inject design template data into any post's metadata on a WordPress site. This could lead to unauthorized modifications of sensitive data, potentially violating compliance requirements for GDPR (data integrity) and HIPAA (unauthorized access to protected health information).

Mitigation Strategies

Update the 'Product Designer' plugin to the latest version beyond 1.0.40. If an update is unavailable, consider disabling or removing the plugin immediately. Review post metadata for unauthorized changes and restrict user permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87844. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart