CVE-2024-3608

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments. CVE-2024-38726 appears to be a duplicate of this issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
pickplugins	PickPlugins Product Designer for WooCommerce	<= 1.0.33
pickplugins	product_designer	<= 1.0.33

References

Timeline

Published: Jul 9, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-360809.8Westermo EDW-100 devices through 2024-05-03 have a hidden root user account with a hardcoded password that cannot be changed. NOTE: this is CVE-2024-360819.8Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. CVE-2024-360826.5SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an adm CVE-2024-36094.3The ReviewX – Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a m CVE-2024-36105.3The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th CVE-2024-361036.8OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent at CVE-2024-361049.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBi CVE-2024-361055.3dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. CVE-2024-361064.3Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by nam CVE-2024-361075.3MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Sin CVE-2024-361089.8casgate is an Open Source Identity and Access Management system. In affected versions `casgate` allows remote unauthenticated attacker to ob CVE-2024-361097.6CoCalc is web-based software that enables collaboration in research, teaching, and scientific publishing. In affected versions the markdown