YITH WooCommerce Wishlist EUVD-2026-75965

No special conditions - remote unauthenticated exploitation against any WordPress site running YITH WooCommerce Wishlist before 4.18.1 that has at least one wishlist created. The attacker must supply a valid wishlist identifier; these IDs may be exposed in share URLs, page source, or discoverable via enumeration. No authentication, no elevated privileges, no user interaction, and no non-default configuration are required. Limiting factors: impact is confined to renaming wishlist names only; an attacker with no knowledge of existing wishlist IDs cannot exploit the flaw blindly without a discovery step.

CVSS 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately characterizes the constrained impact: the flaw is trivially automatable and requires no credentials or user interaction, yet the blast radius is limited strictly to wishlist name integrity. An attacker cannot exfiltrate data, execute code, delete wishlists, or disrupt site availability through this vector alone. The existence of a publicly available WPScan POC lowers the skill threshold to near zero, making mass-scanning and automated opportunistic exploitation plausible. However, the absence of a CISA KEV listing and the low-severity real-world consequence (reputational nuisance / customer confusion rather than data breach) keep this firmly in the 'patch promptly, not urgently' category. EPSS data was not provided. No conflicting signals: CVSS vector and description are fully consistent.

An unauthenticated attacker visits a WooCommerce storefront, browses public wishlist pages or product pages to extract wishlist IDs exposed in page source or share URLs, then issues HTTP requests to the rename endpoint with arbitrary target names - no credentials required. Using the publicly available WPScan POC, the attacker could automate mass-renaming of all customer wishlists to offensive or misleading strings, degrading the shopping experience and the store's reputation.