---
id: "CVE-2026-87844"
kind: "vulnerability"
aliases: ["CVE-2026-87844"]
title: "WordPress: Product Designer for WooCommerce lets anyone write post metadata"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-inactive", "plugin-not-installed"]
published_at: "2026-10-18T07:16:53+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:26:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87844", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# WordPress: Product Designer for WooCommerce lets anyone write post metadata

The PickPlugins Product Designer for WooCommerce plugin, through version 1.0.40, skips capability checks and has inverted nonce verification. An unauthenticated visitor can write design template data into the metadata of any post on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the PickPlugins Product Designer for WooCommerce plugin in the WordPress admin plugin list or in `wp-content/plugins/`.
- Confirm whether the plugin is active on the site.

## Fix

- Update the PickPlugins Product Designer for WooCommerce plugin to a version later than `1.0.40`, or remove it if no update is available.
- unknown: the sources do not name a patched version.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87844

## From the sources

The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_