YITH Product Add-Ons CVE-2026-66480

No special conditions beyond running an affected version - remote unauthenticated exploitation is possible against the YITH WooCommerce Product Add-Ons plugin (versions through 4.34.0) per the AV:N/AC:L/PR:N/UI:N vector. The primary limiting factors are that the target must have this specific plugin installed and active on a WooCommerce/WordPress site, must be on an unpatched version (≤4.34.0), and that impact is limited to disclosure of a bounded set of sensitive data (C:L) rather than full database or system compromise. The description does not name a specific feature or non-default configuration as a prerequisite, implying default installations are affected.

This is a moderate-severity information disclosure flaw (CVSS 5.3) in the YITH WooCommerce Product Add-Ons WordPress plugin. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction, which is a genuinely attacker-friendly profile - but the impact is confined to low confidentiality (C:L/I:N/A:N), meaning only a subset of sensitive data is exposed with no integrity or availability consequence. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no positive signal of active or imminent exploitation; the signals are not conflicting so much as incomplete. CWE-497 (Exposure of Sensitive System Information) combined with Patchstack's description ('Retrieve Embedded Sensitive Data') is consistent with the CVSS confidentiality-only rating. On balance this is a real but lower-priority issue: easy to exploit yet limited in blast radius. Absent EPSS/KEV/POC data, it should be patched on a normal cadence rather than treated as an emergency, with priority rising if the exposed data includes credentials, keys, or PII.

A remote, unauthenticated attacker sends a crafted request to a WooCommerce store running a vulnerable version (≤4.34.0) of the YITH Product Add-Ons plugin and retrieves sensitive embedded data the plugin fails to protect. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no login, no special timing, and no victim interaction are required. No public exploit code was identified in the provided data, so exploitation currently requires the attacker to independently discover the vulnerable endpoint/parameter.