The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_options function in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify site options, including setting the default role to administrator which can allow privilege escalation.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Fancy Product Designer Plugin | — | Update fancy-product-designer plugin to version 4.7.0, or a newer patched version | May 15, 2025 | Apr 5, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub