YITH WooCommerce Wishlist: A security weakness
YITH WooCommerce Wishlist is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 4.13.0.
- Component
- YITH WooCommerce Wishlist
- Plugin slug
yith-woocommerce-wishlist- Affected
- < 4.13.0
- Safe version
4.13.0- Published
- Apr 10, 2026
- Weakness
- Not assigned
This CVE was published Apr 10, 2026 and is one of 7 known issues for this plugin.
Update, patch or deactivate.
Update YITH WooCommerce Wishlist to 4.13.0 or later, or disable and remove it until a fixed version is available.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N