The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability check on multiple AJAX functions in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify plugin settings, including retrieving arbitrary order information or creating/updating/deleting products, orders, or other sensitive information not associated with their own account.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-10-20T06:35:28.661Z
Updated: 2024-09-11T18:36:34.757Z
Reserved: 2023-04-05T18:25:26.209Z
Link: CVE-2021-4335
Vulnrichment
Updated: 2024-08-03T17:23:10.681Z
NVD
Status : Modified
Published: 2023-10-20T07:15:14.757
Modified: 2024-11-21T06:37:26.793
Link: CVE-2021-4335
Redhat
No data.