Unauthenticated Directory Traversal in WordPress Product Designer App Plugin

The Product Designer App plugin for WordPress, in all versions up to and including 1.1.3, contains a critical directory traversal vulnerability. Attackers can leverage this flaw to read arbitrary files from the underlying server filesystem. The plugin attempts to gate access to the vulnerable endpoint using a nonce and token mechanism; however, these values are rendered as global JavaScript variables on any page that utilizes the [pdapp-studio-page] shortcode. Because these credentials are publicly accessible to any anonymous visitor, the security control is effectively bypassed. This allows unauthenticated remote attackers to perform unauthorized file reads, potentially accessing sensitive configuration files, credentials, or system data. Defenders should prioritize updating the plugin to the latest patched version or removing the plugin if it cannot be immediately updated.

Attack Chain

1. Attacker identifies a WordPress site running the Product Designer App plugin.
2. Attacker visits any page on the target site that renders the [pdapp-studio-page] shortcode.
3. Attacker parses the page source to extract the nonce and token values exposed as JavaScript global variables.
4. Attacker crafts a malicious HTTP request targeting the plugin endpoint, incorporating the harvested nonce and token for authentication.
5. Attacker injects directory traversal sequences (e.g., ../) into the 'svg' parameter of the request.
6. The plugin processes the input, failing to validate the path traversal, and returns the requested system file content in the HTTP response.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files on the web server. This can lead to the exposure of database credentials in wp-config.php, sensitive application environment variables, or private source code, facilitating full site compromise or lateral movement within the hosting environment.

Recommendation

• Immediately update the Product Designer App plugin to a version later than 1.1.3 once a vendor patch is released.
• If no patch is available, disable or uninstall the plugin to eliminate the exposure of the vulnerable [pdapp-studio-page] shortcode.
• Implement web application firewall (WAF) rules to detect and block requests to the vulnerable plugin endpoint containing directory traversal sequences (e.g., ../, ../) in the 'svg' parameter.
• Audit access logs for high-frequency requests originating from single IPs targeting plugin-specific paths to identify potential automated scanning or exploitation attempts.