VulnTitan VulnTitan Security command center
Vulnerability Report
Plugin High Patch path listed CVE-2021-4334

Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options

The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_options function in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify site options, including setting the default role to administrator which can allow privilege escalation.

Quick Answer

CVE-2021-4334 is a high severity with CVSS 8.8 Privilege Escalation issue affecting the Plugin Fancy Product Designer. It affects Versions up to 4.6.9 and is fixed in 4.7.0.

Back to Feed View Plugin Hub Open CVE Reference
Published
Apr 05, 2023
Last Updated
Jan 22, 2024
Slug
fancy-product-designer
Operational Summary

What the operator needs to know

Share Email
Patch Status
Patched release is available
Remediation
Update to version 4.7.0, or a newer patched version
Operator Briefing

CVE-2021-4334 is tracked for the Plugin Fancy Product Designer as high severity with CVSS 8.8. The affected range is Versions up to 4.6.9. Update Fancy Product Designer to 4.7.0 or newer where that version is compatible with the site.

Issue Type
Privilege Escalation
Primary Fixed Version
4.7.0
Primary Affected Range
Versions up to 4.6.9
Tracking ID
CVE-2021-4334
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/ea097cb7-85f4-4b6d-9f29-bc2636993f21?source=api-prod
Detailed Metadata
Software Type Plugin
Software Slug
fancy-product-designer View on wordpress.org
CVE CVE-2021-4334
Patched Versions
4.7.0
Affected Versions
Versions up to 4.6.9
Related CVE Cluster

Related CVEs for Fancy Product Designer

These internal links group the same WordPress plugin by CVE, issue type, severity, and patch status so operators and search engines can connect the full vulnerability cluster.

Critical CVE-2024-51919 6.4.4 Jan 03, 2025
CVE-2024-51919 Fancy Product Designer Remote Code Execution

Fancy Product Designer <= 6.4.3 - Unauthenticated Arbitrary File Upload

Critical CVE-2021-24370 4.6.9 Jun 01, 2021
CVE-2021-24370 Fancy Product Designer Remote Code Execution

Fancy Product Designer <= 4.6.8 - Unauthenticated Arbitrary File Upload

Critical CVE-2024-0365 6.1.5 Feb 20, 2024
CVE-2024-0365 Fancy Product Designer SQL Injection

Fancy Product Designer <= 6.1.4 - Authenticated (Admin+) SQL Injection

High CVE-2021-4096 4.7.6 Apr 14, 2022
CVE-2021-4096 Fancy Product Designer Arbitrary File Upload

Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload

High CVE-2024-51818 6.4.4 Jan 03, 2025
CVE-2024-51818 Fancy Product Designer SQL Injection

Fancy Product Designer <= 6.4.3 - Unauthenticated SQL Injection

High CVE-2025-12570 6.5.0 Dec 11, 2025
CVE-2025-12570 Fancy Product Designer File Upload

Fancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

High CVE-2021-4134 4.7.5 Feb 08, 2022
CVE-2021-4134 Fancy Product Designer SQL Injection

Fancy Product Designer <= 4.7.4 - Admin+ SQL Injection

Medium CVE-2025-13231 6.5.0 Dec 15, 2025
CVE-2025-13231 Fancy Product Designer Server-Side Request Forgery

Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition

Licensing Notices

This record contains material that is subject to copyright

DEFIANT
Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more

MITRE
Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more