Please remove – delete the Fancy Product Designer Plugin plugin!
This plugin suffers from Unauthenticated Arbitrary File Upload, where users can upload arbitrary files including PHP files to the server, resulting in a Remote Code Execution (RCE).
The second vulnerability is Unauthenticated SQL Injection which allows any users to execute arbitrary SQL queries in the database of the WordPress site.
Details:
https://patchstack.com/articles/critical-vulnerabilities-found-in-fancy-product-designer-plugin/