CVE-2024-3608

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-3608
The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments. CVE-2024-38726 appears to be a duplicate of this issue.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset/3129823/product-designer/trunk/includes/designer-function.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/2f127fe5-67b8-40e1-a916-c607410b08b3?source=cve
https://plugins.trac.wordpress.org/browser/product-designer/trunk/includes/designer-function.php#L412
https://www.wordfence.com/threat-intel/vulnerabilities/id/2f127fe5-67b8-40e1-a916-c607410b08b3?source=cve
Configurations

No configuration.

History

08 Apr 2026, 17:18

Type Values Removed Values Added
References
  • () https://plugins.trac.wordpress.org/changeset/3129823/product-designer/trunk/includes/designer-function.php -
Summary (en) The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments. (en) The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments. CVE-2024-38726 appears to be a duplicate of this issue.
CWE CWE-862

21 Nov 2024, 09:29

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/product-designer/trunk/includes/designer-function.php#L412 - () https://plugins.trac.wordpress.org/browser/product-designer/trunk/includes/designer-function.php#L412 -
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/2f127fe5-67b8-40e1-a916-c607410b08b3?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/2f127fe5-67b8-40e1-a916-c607410b08b3?source=cve -

09 Jul 2024, 18:19

Type Values Removed Values Added
Summary
  • (es) El complemento Product Designer para WordPress es vulnerable a la pérdida no autorizada de datos debido a una falta de verificación de capacidad en la función product_designer_ajax_delete_attach_id() en todas las versiones hasta la 1.0.33 incluida. Esto hace posible que atacantes no autenticados eliminen archivos adjuntos arbitrarios.

09 Jul 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-09 09:15

Updated : 2026-04-08 17:18

NVD link : CVE-2024-3608

Mitre link : CVE-2024-3608

CVE.ORG link : CVE-2024-3608

JSON object : View

Products Affected

No product.

CWE
CWE-862

Missing Authorization