YITH Product Add-Ons EUVD-2026-114299

The target must be a WordPress site with the YITH WooCommerce Product Add-Ons plugin installed at version 4.34.0 or earlier; per the CVSS vector (PR:N/UI:N) exploitation is unauthenticated and requires no user interaction. The exact feature, endpoint, or configuration abused is not described in the available sources - the description only labels it an 'Unauthenticated Bypass' and the CWE-639 category indicates a user-controlled-key authorization bypass. Limiting factors: impact is confined to limited integrity (C:N/A:N), so there is no direct data disclosure or denial of service, and exploitation depends on the vulnerable plugin being active; whether specific plugin settings or product-add-on configurations are required is not stated in the sources.

This is a moderate-severity authorization/bypass issue (CVSS 5.3) whose signals point to low-to-moderate real-world priority rather than an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, but impact is deliberately narrow: C:N/I:L/A:N - only a limited integrity effect, with no confidentiality or availability impact, consistent with CWE-639 (Authorization Bypass Through User-Controlled Key). The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the bounded impact. No CISA KEV listing is present and no EPSS score was supplied, so there is no evidence of active or probable mass exploitation; the only reference is the Patchstack advisory itself, which is an advisory entry, not verified working exploit code. The main caveat is specificity: the description ('Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0') does not state what control is bypassed or how it is triggered, so the precise attacker benefit is inferred from CWE-639 and the limited-integrity CVSS impact rather than confirmed from the source. Treat as a scheduled-patch item, not a drop-everything emergency.

A remote, unauthenticated attacker sends a crafted request to a WordPress site running YITH WooCommerce Product Add-Ons 4.34.0 or earlier, abusing a user-controlled key to bypass an authorization check and modify data the attacker should not be able to change (limited integrity impact). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required; however, the exact bypassed function and trigger are not described in the available sources. No verified public exploit code was identified at the time of analysis.