CVE-2026-75098Published
Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-75098 · Microsoft / collected KEV context
cve-program · CVE-2026-75098
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e94db231-e5d4-4b49-ad36-74c0284abfd2?source=cve
- https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/includes/productdesignerapp-helpers.php#L2867
- https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/includes/productdesignerapp-front-ajax.php#L625
- https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/includes/productdesignerapp-helpers.php#L261
- https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/templates/default/script/variants.php#L22
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.