CVE-2026-75098CWE-22path-traversal

CVE-2026-75098

High · published September 30, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
59.3
In the wild
Unconfirmed
What it is

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00900 · 59.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-30T13:17Z
References (5)
https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/includes/productdesignerapp-front-ajax.php#L625 · [email protected]https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/includes/productdesignerapp-helpers.php#L261 · [email protected]https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/includes/productdesignerapp-helpers.php#L2867 · [email protected]https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/templates/default/script/variants.php#L22 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/e94db231-e5d4-4b49-ad36-74c0284abfd2?source=cve · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 1%
    epss
  • 30 SEP 08:28Z
    Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
    cvelistv5