{"id":"CVE-2026-87844","kind":"vulnerability","aliases":["CVE-2026-87844"],"related":[],"title":"WordPress: Product Designer for WooCommerce lets anyone write post metadata","description":"The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.","summary":"The PickPlugins Product Designer for WooCommerce plugin, through version 1.0.40, skips capability checks and has inverted nonce verification. An unauthenticated visitor can write design template data into the metadata of any post on the site.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-inactive","plugin-not-installed"],"how_to_check":"- Check the installed version of the PickPlugins Product Designer for WooCommerce plugin in the WordPress admin plugin list or in `wp-content/plugins/`.\n- Confirm whether the plugin is active on the site.","fix":"- Update the PickPlugins Product Designer for WooCommerce plugin to a version later than `1.0.40`, or remove it if no update is available.\n- unknown: the sources do not name a patched version.","status":"open","published_at":"2026-10-18T07:16:53+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:26:44+00:00","updated_at":"2026-10-25T04:26:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:26:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the PickPlugins Product Designer for WooCommerce plugin to a version later than `1.0.40`, or remove it if no update is available.\n- unknown: the sources do not name a patched version.","reach":"internet","title":"WordPress: Product Designer for WooCommerce lets anyone write post metadata","impact":"medium","summary":"The PickPlugins Product Designer for WooCommerce plugin, through version 1.0.40, skips capability checks and has inverted nonce verification. An unauthenticated visitor can write design template data into the metadata of any post on the site.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated users alter metadata on any site post","analyst_note":"Confirm the fixed plugin version and the exact vulnerable endpoint from the NVD entry or the plugin vendor's changelog.","how_to_check":"- Check the installed version of the PickPlugins Product Designer for WooCommerce plugin in the WordPress admin plugin list or in `wp-content/plugins/`.\n- Confirm whether the plugin is active on the site.","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-inactive"],"who_is_affected":"Sites running the PickPlugins Product Designer for WooCommerce plugin at version 1.0.40 or earlier are exposed, because the flawed endpoint is reachable without logging in. Sites that do not have the plugin installed or active can skip it. Whether a specific site is reachable from the internet depends on its own setup, which the sources do not describe.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":3344,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87844':13A,16A '1.0.40':32B,67C 'absent':86C 'accept':80C 'allow':104C 'anyon':7A 'capabl':34B,72C 'check':35B,73C 'cve':11A,14A 'data':48B,100C,111C 'design':3A,26B,46B,61C,109C 'host':20B 'insert':108C 'invalid':84C 'invert':38B,79C 'let':6A 'metadata':10A,51B,114C 'nonc':39B,76C,87C 'one':91C 'packag':17B 'perform':70C 'pickplugin':24B,59C 'plugin':29B,65C 'post':9A,54B,98C,117C 'product':2A,25B,60C 'reject':89C 'request':81C 'self':19B 'self-host':18B 'site':57B,120C 'skip':33B 'templat':47B,110C 'unauthent':42B,105C 'user':106C 'valid':90C,96C 'verif':40B,77C 'version':31B 'visitor':43B 'woocommerc':5A,21B,28B,63C 'wordpress':1A,22B,64C 'write':8A,45B 'written':102C","nicknames":[],"mitigations":[],"who_affected":"Sites running the PickPlugins Product Designer for WooCommerce plugin at version 1.0.40 or earlier are exposed, because the flawed endpoint is reachable without logging in. Sites that do not have the plugin installed or active can skip it. Whether a specific site is reachable from the internet depends on its own setup, which the sources do not describe.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87844","severity":null,"published_at":"2026-10-18T07:16:53+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}