CVE-2021-4334: 
WordPress vulnerability analysis and mitigation

The Fancy Product Designer plugin for WordPress contains a security vulnerability (CVE-2021-4334) that was disclosed on October 20, 2023. The vulnerability affects versions up to and including 4.6.9, where unauthorized modification of site options is possible due to a missing capability check on the fpdupdateoptions function (NVD Results).

The vulnerability stems from insufficient authorization controls in the fpdupdateoptions function. The CVSS v3.1 score for this vulnerability is 8.8 (HIGH), indicating its serious nature. The technical issue revolves around a missing capability check that should restrict access to site option modifications (NVD Results).

The vulnerability allows authenticated attackers with subscriber-level permissions to modify site options. Most critically, attackers can manipulate the default role settings to grant themselves administrator privileges, effectively enabling privilege escalation on affected WordPress installations (NVD Results).

Website administrators running the Fancy Product Designer plugin should update their installations to a version newer than 4.6.9 to address this vulnerability. The issue has been fixed in subsequent releases (NVD Results).