CVE-2026-87844: CWE-862 Missing Authorization in PickPlugins Product Designer for WooCommerce

CVE-2026-87844 describes a missing authorization vulnerability (CWE-862) in the PickPlugins Product Designer for WooCommerce WordPress plugin through version 1.0.40. The plugin does not perform any capability checks before processing requests and has an inverted nonce verification logic that accepts requests with invalid or missing nonces while rejecting valid ones. Additionally, it does not validate the target post for the data insertion, enabling unauthenticated attackers to insert arbitrary design template data into the metadata of any post on the affected WordPress site.

An unauthenticated attacker can exploit this vulnerability to insert arbitrary design template data into the metadata of any post on the site. This could lead to unauthorized modification of post content or metadata, potentially impacting site integrity and content trustworthiness. No information about exploitation in the wild or further impact such as code execution or data disclosure is provided.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's functionality where possible and monitor for suspicious activity related to post metadata modifications.