Fancy Product Designer SQL injection

Technical summary

Fancy Product Designer is a commercial WordPress and WooCommerce product-customisation plugin. One of its parameters is used in an SQL statement without being sanitised or escaped.

The published description and vector put the bar at administrator level, which is why this entry carries the lowest published score on the index.

Impact

Arbitrary database queries from an administrative account, beyond what the plugin’s own interface allows.

The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by adminstrators.

Remediation

WPScan records the issue as fixed in version 6.1.5.

Disclosure timeline

1. 2024-02-20WPScan advisory published
2. 2024-03-18CVE record published

Only publicly documented dates are shown. Where a step in the process was not published, it is not listed.

References

• NVD entry
• CVE record (MITRE)
• WPScan advisory

We publish advisories, not exploits. Each entry describes the vulnerability class and impact at the level the vendor advisory does, and links to the authoritative records. Where public proof-of-concept code exists we link to it rather than reproduce it.