YITH WooCommerce Wishlist CVE-2026-27329

The vulnerability requires the YITH WooCommerce Wishlist plugin to be installed and activated on the target WordPress site. The specific attack vector targets wishlist object manipulation endpoints (typically WordPress AJAX handlers) that accept user-controlled wishlist identifiers without proper authorization checks. Exploitation does not require authentication, user interaction, or non-default configuration - standard plugin installation with default settings exposes the vulnerability. The attack is limited to integrity modification of wishlist data only; the attacker cannot read arbitrary wishlist contents (no confidentiality impact per CVSS) and cannot achieve remote code execution or service denial. Exploitation is further constrained by WordPress's security model: the attacker cannot modify core WooCommerce or user account data, only wishlist entries managed by the vulnerable plugin.

The CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-accessible integrity impact with low attack complexity and no authentication required, placing this in the medium-risk range for WordPress deployments. The absence of confidentiality or availability impact limits real-world damage to wishlist data tampering rather than data theft or service disruption. However, the integrity impact on user wishlists could affect customer experience and trust, particularly in e-commerce contexts where wishlist data influences purchasing decisions. No EPSS score, KEV status, or public exploit code is provided in available intelligence, suggesting limited current real-world exploitation despite straightforward attack requirements. The Patchstack source indicates vendor awareness and patch availability, reducing the urgency window for active defense. For WordPress sites, the attack surface is limited to installations with the plugin active; WordPress security best practices (keeping plugins updated, limiting administrative access) significantly reduce exploitability.

An unauthenticated attacker enumerates wishlist IDs by observing URL patterns or making sequential requests, then sends a crafted HTTP POST request to the WordPress AJAX endpoint manipulating the yith-wishlist action parameter with a target wishlist ID they do not own. The server processes the request without validating ownership, allowing the attacker to add, remove, or modify items in another user's wishlist. This could be automated to poison wishlist recommendations across multiple customers or disrupt store operations.