YITH WooCommerce Popup CVE-2026-92426

Requires a valid authenticated account on the target WordPress site holding the Contributor role or higher; this is the key limiting factor, so the site must allow Contributor-level (or multi-author) registration or the attacker must already hold such an account. No end-user interaction is needed (UI:N) and no special non-default plugin configuration is described - any site running YITH WooCommerce Popup before 1.60.0 with at least one low-privilege account is affected. The impact is bounded to deletion of post meta on arbitrary posts (integrity only); there is no confidentiality or availability compromise and no code execution, which constrains realistic damage to content/metadata corruption.

This is a genuine but moderate-priority issue, not a high-urgency one. The CVSS base score is 4.9 (medium), and the CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) reports network vector with low complexity but requires privileges and yields integrity-only impact (C:N/A:N). Note a discrepancy: the input vector sets PR:H, yet the description states the flaw is exploitable by the Contributor role 'and above' - Contributor is a low-privilege authenticated role, so PR:L is the more accurate choice, which would modestly raise the realistic score. All exploitation signals point to low real-world urgency: EPSS is 0.16% (5th percentile), there is no CISA KEV listing, and the technical impact is bounded to deleting post meta (an authorization/IDOR-class flaw, CWE-863), not code execution or data disclosure. A public exploit does exist (reported by WPScan), which raises the floor on exploitability, but POC availability is a distinct signal from active exploitation and should not be conflated with in-the-wild use. Net: patch in normal cycle; the pre-authentication barrier (a valid Contributor+ account) and the limited, integrity-only impact keep this well below internet-facing RCE-class priorities.

An authenticated user holding at least the Contributor role (for example a guest author on a multi-author WordPress site) sends a crafted request to the plugin's vulnerable AJAX/post-meta handler, which deletes post meta without verifying the caller's capability. Because the handler does not check ownership, the attacker deletes meta from posts owned by Editors or Administrators - corrupting SEO fields, custom fields, or content settings. A public exploit for this vector is available via WPScan, lowering the effort required.