The PickPlugins Product Designer for WooCommerce plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the product_designer_ajax_delete_attach_id() function. This flaw allows unauthenticated attackers to delete arbitrary attachments due to the absence of a capability check. The issue affects all versions up to 1.0.33. CVE-2024-38726 is a duplicate of this vulnerability. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, no privileges required, no user interaction, and impact limited to availability loss. No official patch or vendor advisory is currently provided.

An attacker without authentication can delete arbitrary attachments managed by the plugin, causing availability disruption of those attachments. There is no impact on confidentiality or integrity according to the CVSS vector. This could affect website functionality relying on these attachments but does not allow data disclosure or modification beyond deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin's AJAX endpoints where possible and monitor for suspicious deletion activity. Avoid exposing the plugin to untrusted users or unauthenticated requests. Follow vendor updates closely for an official fix.