Yith Woocommerce Wishlist EUVD-2026-21317

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) correctly identifies network accessibility with no authentication required and low attack complexity. However, the EPSS score of 0.02% (percentile 6%) provides critical context: despite the moderate CVSS rating, real-world exploitation probability is very low. This discrepancy exists because exploitation is limited to the narrow population of WordPress sites using this specific plugin, and the attack provides limited practical value (wishlist renaming does not lead to financial loss, credential theft, or system compromise). The availability of public exploit code is notable but does not materially increase risk given the low business impact of wishlist tampering. SSVC analysis suggests: exploitation is possible (POC exists), impact is technical but limited to integrity and information disclosure, and remediation is straightforward (plugin update). This is categorized as a legitimate but lower-priority vulnerability for WordPress administrators.

An attacker navigates to any WordPress site running YITH WooCommerce Wishlist (version below 4.13.0) and accesses the public /wishlist/ page, extracting the nonce value embedded in the page HTML. Using this nonce and publicly available exploit code, the attacker crafts an AJAX request to the save_title() handler with a target wishlist ID belonging to another user and a new malicious name (e.g., containing spam or defamatory content). The vulnerable plugin processes the request, changes the wishlist name without verifying ownership, and the tampering succeeds. The attacker has no need for authentication, credentials, or user interaction-only the public nonce-making this a straightforward CSRF-like attack.