Vulnerability · Published Oct 18, 2026 · Assigned by WPScan

CVE-2026-87844Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection

Medium 5.3

In plain English

A medium-severity missing authorization in PickPlugins Product Designer for WooCommerce from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 91.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.

Affected products (as reported)

Vendor	Product	Versions
Unknown	PickPlugins Product Designer for WooCommerce	0 – through 1.0.40

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/648c7a32-1fc8-44a9-8f52-3aab81a2de55/ exploit, vdb-entry, technical-description