CVE-2024-3608: 
WordPress vulnerability analysis and mitigation

The Product Designer plugin for WordPress contains a vulnerability (CVE-2024-3608) discovered and disclosed on July 9, 2024. The vulnerability affects all versions up to and including 1.0.33. This security issue stems from a missing capability check in the product_designer_ajax_delete_attach_id() function, which creates a potential security risk (NVD CVE).

The vulnerability is characterized by a missing authorization check in the product_designer_ajax_delete_attach_id() function. The issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating that it can be exploited over the network with low attack complexity and requires no privileges or user interaction (Wordfence Intel).

The vulnerability allows unauthenticated attackers to delete arbitrary attachments from the WordPress installation, potentially leading to unauthorized loss of data (NVD CVE).

The vulnerability can be exploited by unauthenticated attackers remotely, requiring no special privileges or user interaction. The low attack complexity makes it relatively straightforward to exploit (Wordfence Intel).

Users should update their Product Designer plugin to a version newer than 1.0.33 if available. The vulnerability is present in the function located at designer-function.php (WordPress Plugin).