CVE-2026-75098

Name of the Vulnerable Software and Affected Versions Product Designer App plugin for WordPress versions prior to 1.1.4

Description A Directory Traversal issue exists where unauthenticated attackers can read arbitrary files from the server, potentially exposing sensitive information. This is possible via the svg parameter. The authentication mechanism for the affected endpoint relies on a nonce and token that are exposed as JavaScript globals on any page using the [pdapp-studio-page] shortcode, allowing anonymous visitors to obtain them.

Recommendations Update the Product Designer App plugin for WordPress to version 1.1.4 or later. As a temporary mitigation, avoid using the svg parameter in the affected endpoint.