CVE-2026-75098

Summary

The Product Designer App plugin allows unauthenticated attackers to perform directory traversal attacks by manipulating the 'svg' parameter, enabling them to read arbitrary files on the server that may contain sensitive data.

Exploitability

Exploitation is straightforward as attackers can directly access the vulnerable endpoint with any SVG parameter value, requiring no authentication or special conditions beyond knowing the plugin's URL structure.

Blast radius

The impact could be significant as attackers might gain access to configuration files, database credentials, or other sensitive server files that could lead to further compromise of the WordPress installation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.1.4 or later which fixes the directory traversal vulnerability in the Product Designer App plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.