The vulnerability arises because the PickPlugins Product Designer for WooCommerce plugin fails to verify user capabilities and inverts its nonce check. The plugin therefore accepts requests that contain an invalid or missing nonce, while rejecting those that are valid. As a result, any unauthenticated user can send a request to the plugin endpoint and write arbitrary design template data into the metadata of any post on the site. This can lead to the inclusion of malicious content, unintended alteration of post data, or potential cross‑site scripting if the data is later rendered without proper sanitization. Based on this behavior, it is inferred that an attacker could exploit the stored data as a vector for XSS, especially on frontend pages that display design templates.

This flaw exists in the Product Designer for WooCommerce plugin supplied by PickPlugins for WordPress versions up to and including 1.0.40. Hosts running this plugin are therefore vulnerable; newer releases are not affected.

Because the vulnerability is exploitable by anyone on the internet without authentication, the risk is high. The EPSS score of 0.00136 indicates a very low but non-zero exploitation probability, meaning an attacker can craft a request from any domain. The CVSS score of 5.3 indicates a moderate severity. The vulnerability is not listed in the CISA KEV catalog and no public exploit has been reported. Nonetheless, the uncontrolled data injection could be leveraged for defacement, injection of malicious scripts or to manipulate e‑commerce product pages.