CVE-2026-87844: Product Designer for WooCommerce Auth Bypass

CVE-2026-87844 Overview

CVE-2026-87844 affects the PickPlugins Product Designer for WooCommerce WordPress plugin through version 1.0.40. The plugin fails to perform capability checks on an AJAX endpoint that writes design template data to post metadata. Its nonce verification logic is inverted, so the handler accepts requests carrying an invalid or absent nonce while rejecting requests with a valid one. The handler also fails to validate the target post identifier. Unauthenticated attackers can therefore insert arbitrary design template data into the metadata of any post on the affected site, classified as missing authorization [CWE-862].

Critical Impact

Unauthenticated remote attackers can write attacker-controlled metadata to arbitrary posts across any site running the vulnerable plugin.

Affected Products

• PickPlugins Product Designer for WooCommerce (WordPress plugin)
• All versions through 1.0.40
• WordPress sites running WooCommerce with the plugin enabled

Discovery Timeline

• 2026-10-18 - CVE-2026-87844 published to the National Vulnerability Database
• 2026-10-19 - Last updated in the NVD database

Technical Details for CVE-2026-87844

Vulnerability Analysis

The plugin exposes an AJAX handler intended to save product design template data to WordPress post metadata. The handler contains three independent flaws that combine to allow unauthenticated metadata injection. First, the handler performs no capability check, meaning WordPress does not verify whether the caller holds any role or privilege. Second, the Cross-Site Request Forgery (CSRF) nonce verification is inverted: the handler proceeds when wp_verify_nonce() returns false and halts when it returns true. Third, the handler does not validate that the target post identifier belongs to a product or is otherwise writable by the request originator. Attackers can POST crafted data to the AJAX endpoint and write design template values to the postmeta table for any post_id on the site, including pages, posts, and custom post types unrelated to WooCommerce.

Root Cause

The root cause is a combination of missing authorization [CWE-862] and inverted CSRF nonce logic. The handler was registered under both wp_ajax_ and wp_ajax_nopriv_ hooks, exposing it to unauthenticated callers, while the only remaining guard, the nonce check, is coded with reversed boolean semantics. The absence of post-type validation on the supplied identifier removes any remaining scope limit.

Attack Vector

Exploitation requires only network access to the WordPress admin-ajax.php endpoint. An attacker sends a POST request to the vulnerable action with a chosen post_id and attacker-supplied template data, deliberately omitting or corrupting the nonce value. The server writes the data into post metadata without further validation. Refer to the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-87844

Indicators of Compromise

• Unexpected entries in the wp_postmeta table containing product designer template keys associated with posts that are not WooCommerce products.
• POST requests to /wp-admin/admin-ajax.php referencing the Product Designer save action from unauthenticated sessions.
• Modifications to post metadata timestamps on pages that administrators did not edit.

Detection Strategies

• Audit the wp_postmeta table for plugin-specific meta keys attached to post_id values that are not of the product post type.
• Enable WordPress request logging and alert on admin-ajax.php POST requests to the Product Designer action originating from unauthenticated clients.
• Compare installed plugin versions against 1.0.40 across managed WordPress estates and flag vulnerable installations.

Monitoring Recommendations

• Forward web server access logs and WordPress audit logs to a centralized analytics platform for correlation.
• Create alerts for high-volume POST traffic to admin-ajax.php from single source addresses targeting the vulnerable action.
• Monitor file integrity and database changes on WooCommerce sites for unexpected metadata writes outside administrator sessions.

How to Mitigate CVE-2026-87844

Immediate Actions Required

• Deactivate the PickPlugins Product Designer for WooCommerce plugin on all sites running version 1.0.40 or earlier until a fixed release is confirmed.
• Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible using a Web Application Firewall (WAF).
• Review wp_postmeta for unauthorized template entries and remove attacker-supplied values.

Patch Information

At the time of publication, no vendor-supplied patched release is referenced in the NVD entry. Administrators should monitor the plugin page on WordPress.org and the WPScan Vulnerability Report for an updated version addressing the capability check, nonce verification logic, and post identifier validation.

Workarounds

• Uninstall the plugin until a corrected release is available.
• Deploy a WAF rule to block POST requests to admin-ajax.php targeting the Product Designer save action from unauthenticated sources.
• Restrict administrative endpoints to authenticated IP allowlists where WooCommerce product designer functionality is not actively used.

# Example WAF rule concept (ModSecurity-style) to block unauthenticated calls
# to the vulnerable AJAX action. Adjust the action name per vendor advisory.
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026878440,msg:'Block PickPlugins Product Designer unauth metadata write (CVE-2026-87844)'"
  SecRule ARGS:action "@rx ^product_designer_save" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in_ "@eq 0"