CVE-2021-4335

CVE-2021-4335 is a medium-severity vulnerability affecting the Fancy Product Designer plugin for WordPress, versions up to and including 4.6.9. It stems from missing capability checks in multiple AJAX functions, allowing authenticated attackers with subscriber-level permissions to bypass authorization. This enables unauthorized access to and modification of plugin settings, including retrieving arbitrary order information or manipulating products and orders not associated with their account. While the CVSS score is 6.3 (Medium), indicating low attack complexity and potential for limited impact on confidentiality, integrity, and availability, there is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.