What is the CVSS score of CVE-2026-82305?

CVE-2026-82305 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-82305?

Yes, a public proof-of-concept exploit is available for CVE-2026-82305. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-82305?

Yes, a patch is available for CVE-2026-82305. Update the affected software to the latest version immediately.

YITH WooCommerce Wishlist CVE-2026-82305

EUVD-2026-75965 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-09-11 WPScan

GHSA-8grc-vvw6-6gmr

WordPress Yith Woocommerce Wishlist Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable, no credentials needed, no user interaction; only wishlist name integrity affected, so I:L and C:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 11, 2026 - 11:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 11, 2026 - 11:26 vuln.today

CVSS changed

Sep 11, 2026 - 11:22 NVD

5.3 (MEDIUM)

Patch available

Sep 11, 2026 - 08:16 EUVD

CVE Published

Sep 11, 2026 - 06:00 cve.org

MEDIUM 5.3

CVE Published

Sep 11, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site.

AnalysisAI

Missing authorization on the wishlist rename endpoint in YITH WooCommerce Wishlist (WordPress plugin before 4.18.1) permits any unauthenticated network attacker to rename any customer wishlist sitewide by supplying a target wishlist identifier. The flaw is rooted in CWE-639 - the plugin never verifies that the requesting user owns or has permission over the wishlist identified by a user-controlled key. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against any WordPress site running YITH WooCommerce Wishlist before 4.18.1 that has at least one wishlist created. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately characterizes the constrained impact: the flaw is trivially automatable and requires no credentials or user interaction, yet the blast radius is limited strictly to wishlist name integrity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update YITH WooCommerce Wishlist to version 4.18.1 or later via the WordPress plugin repository (Dashboard → Plugins → Update). … Detailed patch versions, workarounds, and compensating controls in full report.