YITH WooCommerce Zoom Magnifier CVE-2026-28169

No authentication is required - the CVSS vector PR:N/AV:N/AC:L confirms unauthenticated, network-accessible exploitation against any WordPress site with the plugin installed and active. The plugin must be installed, activated, and serving a WooCommerce store. No special attacker-controlled configuration is needed. Exploitation is limited by two factors: the plugin must be actively installed (not just present in the filesystem), and the impact ceiling is C:L, meaning only a subset of potentially sensitive data is accessible rather than full system compromise. Sites running the plugin only in staging or behind authenticated access layers (e.g., HTTP basic auth at the server level) are partially mitigated.

The CVSS 3.1 score of 5.3 (Medium) is composed of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network-accessible exploitation requiring no authentication, no user interaction, and low attack complexity - but with only limited confidentiality impact and no integrity or availability impact. EPSS data was not provided, so exploitation probability cannot be quantified. No CISA KEV listing exists, and no POC code is referenced in available intelligence, suggesting this has not yet been weaponized at scale. The real-world risk is moderate: the low attack complexity and zero-authentication requirement make automated scanning trivial, but the C:L impact ceiling limits the damage ceiling per successful exploitation. Risk escalates if the exposed data includes credentials, API keys, or information enabling secondary attacks. The SSVC exploitation status should be treated as 'none' based on available signals, though the low barriers to exploitation warrant prompt patching.

An unauthenticated attacker sends a crafted HTTP GET or POST request to a target WordPress site's admin-ajax.php endpoint or a REST API route registered by the YITH WooCommerce Zoom Magnifier plugin. The vulnerable handler returns sensitive system or configuration data in the response without performing any authentication or capability check. No POC code has been publicly identified, but the low complexity makes manual discovery via request inspection or automated WordPress plugin scanners straightforward.