{"id":"CVE-2026-75098","published":"2026-09-30T09:17:16.320","lastModified":"2026-09-30T16:18:58.363","description":"The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/includes/productdesignerapp-front-ajax.php#L625","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/includes/productdesignerapp-helpers.php#L261","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/includes/productdesignerapp-helpers.php#L2867","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/templates/default/script/variants.php#L22","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e94db231-e5d4-4b49-ad36-74c0284abfd2?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Product Designer App plugin allows unauthenticated attackers to perform directory traversal attacks by manipulating the 'svg' parameter, enabling them to read arbitrary files on the server that may contain sensitive data.","exploitability":"Exploitation is straightforward as attackers can directly access the vulnerable endpoint with any SVG parameter value, requiring no authentication or special conditions beyond knowing the plugin's URL structure.","blast_radius":"The impact could be significant as attackers might gain access to configuration files, database credentials, or other sensitive server files that could lead to further compromise of the WordPress installation.","remediation":"Upgrade to version 1.1.4 or later which fixes the directory traversal vulnerability in the Product Designer App plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["directory-traversal","file-read","wordpress"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:12:38.539Z"}}