Live › vulnerability › CVE-2026-87844
Go to dashboardThe PickPlugins Product Designer for WooCommerce plugin, through version 1.0.40, skips capability checks and has inverted nonce verification. An unauthenticated visitor can write design template data into the metadata of any post on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the PickPlugins Product Designer for WooCommerce plugin at version 1.0.40 or earlier are exposed, because the flawed endpoint is reachable without logging in. Sites that do not have the plugin installed or active can skip it. Whether a specific site is reachable from the internet depends on its own setup, which the sources do not describe.
No product ranges from the sources yet.
wp-content/plugins/.1.0.40, or remove it if no update is available.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.
This page as .md · .json · in your agent: get_signal("CVE-2026-87844")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.