EUVD-2026-74774
GHSA-jg5j-77hp-vqmp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain Subscriber account on target site
-
DeliveryPOST to wp-admin/admin-ajax.php with action=yith_wcwtl_add_user
-
ExploitInject arbitrary role=administrator via parse_str()+extract() variable pollution
-
Executionwp_create_user() creates attacker-controlled account with administrator role
-
PersistAuthenticate as new administrator
-
ImpactFull WordPress site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid WordPress authenticated session at Subscriber level or above - the lowest role assigned to registered users. On sites with open user registration enabled, an attacker can self-register to satisfy this prerequisite, reducing the effective barrier to network-only. No special plugin configuration, non-default feature flags, or specific WordPress version is required beyond having the plugin active; the vulnerable AJAX hook is registered unconditionally for all logged-in users. There is no rate limiting, CSRF token, or role check to overcome. The sole limiting factor is possession of any authenticated session cookie on the target WordPress installation. |
| Impact | The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes the risk. The attack is network-accessible, requires only subscriber-level authentication (the lowest WordPress role), and demands no special configuration, complexity, or user interaction. On any WordPress site with open user registration enabled, this reduces the effective attacker prerequisite to the ability to receive an email - making exploitation functionally unauthenticated in those deployments. No EPSS data, no CISA KEV listing, and no public POC have been identified in the provided data; however, the attack mechanics are simple enough that security teams should treat this as a high-exploitability issue regardless. The severity is real, not inflated: creating an administrator account yields full C:H/I:H/A:H impact over the WordPress installation. The only meaningful limiting factor is that the attacker must hold some authenticated session on the target site. |
| Exploit ScenarioDerived | An attacker self-registers as a subscriber on a WordPress site with open registration and YITH WooCommerce Waitlist Premium ≤3.35.0 active. With a valid session cookie, the attacker posts to wp-admin/admin-ajax.php with action=yith_wcwtl_add_user and a params field encoding an arbitrary username, email, password, and role=administrator; extract() injects these into wp_create_user() and set_role() with no validation. The attacker immediately logs in with the newly created administrator account and has full control of the site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Privilege escalation in YITH WooCommerce Waitlist Premium for WordPress (versions ≤3.35.0) allows any subscriber-level authenticated user to manufacture a new WordPress administrator account, achieving full site takeover. The vulnerable AJAX handler add_user_in_waiting_list() is exposed to all logged-in users with no nonce or capability check, and applies parse_str() plus extract() to attacker-supplied POST data before passing the injected variables directly to wp_create_user() and $user->set_role(). No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack mechanics are trivially derivable from the Wordfence disclosure.
RemediationAI
Update YITH WooCommerce Waitlist Premium to the latest available version via the YIThemes customer dashboard or yithemes.com; no specific patched release number is confirmed in the available data and must be independently verified from the vendor changelog before deployment. As an immediate compensating control while the update is staged, site administrators should disable open user registration (WordPress Settings → General → uncheck 'Anyone can register') to remove the near-unauthenticated attack path. A WAF rule blocking POST requests to wp-admin/admin-ajax.php with action=yith_wcwtl_add_user from non-administrative sessions will suppress the specific exploit vector without taking the plugin entirely offline, though the trade-off is loss of legitimate waitlist AJAX functionality. Administrators should audit the WordPress user list immediately for any unexpected accounts carrying the administrator role that may have been created prior to detection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The plugin registers add_user_in_waiting_list() on the wp_ajax_yith_wcwtl_add_user WordPress AJAX hook, making it reachable by any authenticated user via POST to wp-admin/admin-ajax.php. The function calls parse_str() on $_POST['params'] and then invokes extract() on the resulting array, importing all caller-supplied key-value pairs into the local PHP scope - a well-documented anti-pattern that constitutes variable injection. These injected values flow directly into wp_create_user() (creating a new WordPress user) and $user->set_role() (assigning the chosen role), with no current_user_can() capability check preventing a subscriber from requesting the administrator role and no nonce to block CSRF-driven exploitation. CWE-269 (Improper Privilege Management) precisely describes the root cause: the function grants the full privilege-assignment capability to every authenticated user, irrespective of their actual authorization level. The affected CPE is cpe:2.3:a:yith:yith_woocommerce_waitlist_premium:*:*:*:*:*:*:*:* covering all versions through 3.35.0.
Know when Yith Woocommerce Waitlist Premium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network AJAX endpoint, subscriber auth required (PR:L), no complexity or interaction; admin account creation yields full C:H/I:H/A:H within the same WordPress scope.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST['params'] that are then passed to wp_create_user() and $user->set_role(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator by creating a new user account and assigning it the administrator role.
Articles & Coverage 1
Executive ViewAI
YITH WooCommerce Waitlist Premium plugin (versions ≤3.35.0) allows any authenticated WordPress subscriber user to create administrator accounts, resulting in complete site compromise. Organizations running affected plugin versions face immediate risk of unauthorized administrative takeover and potential data breach.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately deactivate the plugin; (2) Use WordPress hardening plugins or WAF rules to restrict subscriber-level users from accessing the admin dashboard; (3) Implement monitoring and alerting for new administrator account creation; (4) Restrict WordPress admin panel access to specific IP addresses; (5) Evaluate alternative waitlist plugins or migrate to third-party waitlist service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB