What is the CVSS score of CVE-2026-27329?

CVE-2026-27329 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

YITH WooCommerce Wishlist CVE-2026-27329

EUVD-2026-28334 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-07 Patchstack

GHSA-qjq8-c6gx-g7mg

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 09:01 vuln.today

CVE Published

May 07, 2026 - 07:35 nvd

MEDIUM 5.3

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects YITH WooCommerce Wishlist: from n/a through 4.12.0.

AnalysisAI

Authorization bypass in YITH WooCommerce Wishlist through version 4.12.0 allows unauthenticated remote attackers to modify wishlist data via user-controlled object references, exploiting improper access control validation. The vulnerability enables integrity attacks against wishlist functionality without requiring authentication or user interaction, affecting all WordPress installations using the vulnerable plugin.

Technical ContextAI

YITH WooCommerce Wishlist is a WordPress plugin that extends WooCommerce with customer wishlist functionality. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), a class of access control defect where object identifiers or request parameters directly control authorization decisions without proper validation. The plugin likely uses wishlist IDs or user identifiers passed in HTTP requests to determine data access, but fails to verify that the requesting user actually owns or has permission to modify the target wishlist. This is a variant of Insecure Direct Object Reference (IDOR) in the WordPress plugin context, where wishlist manipulation endpoints do not adequately validate the requester's privilege level against the resource being accessed.

RemediationAI

The primary remediation is to upgrade YITH WooCommerce Wishlist to a patched version beyond 4.12.0. WordPress administrators should navigate to Plugins → Installed Plugins, locate YITH WooCommerce Wishlist, and apply the available update immediately. For sites unable to upgrade immediately, implement network-level controls: restrict direct access to wishlist manipulation endpoints (typically /wp-admin/admin-ajax.php requests with yith-wishlist actions) to authenticated WordPress users only via Web Application Firewall rules, and monitor wishlist database tables for unauthorized modifications. If the plugin cannot be patched or disabled in the short term, consider disabling the wishlist feature entirely through plugin settings until an upgrade path is available. Verify the patched version through Patchstack's advisory at https://patchstack.com/database/wordpress/plugin/yith-woocommerce-wishlist/vulnerability/wordpress-yith-woocommerce-wishlist-plugin-4-12-0-insecure-direct-object-references-idor-vulnerability, which should confirm the exact fixed version number.