Yith
Monthly
Privilege escalation in YITH WooCommerce Waitlist Premium for WordPress (versions ≤3.35.0) allows any subscriber-level authenticated user to manufacture a new WordPress administrator account, achieving full site takeover. The vulnerable AJAX handler add_user_in_waiting_list() is exposed to all logged-in users with no nonce or capability check, and applies parse_str() plus extract() to attacker-supplied POST data before passing the injected variables directly to wp_create_user() and $user->set_role(). No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack mechanics are trivially derivable from the Wordfence disclosure.
Missing authorization in the YITH Request a Quote for WooCommerce Premium plugin (all versions before 4.46.0) lets unauthenticated attackers reach functionality that should be access-controlled, per a Patchstack advisory. The flaw is a broken-access-control / missing-authorization issue (CWE-862) rated CVSS 9.8; no public exploit identified at time of analysis, though the advisory does not detail the exact vulnerable action.
SQL injection in YITH WooCommerce Membership Premium versions 2.33.0 and below allows authenticated subscribers to execute arbitrary SQL queries against the underlying database. Exploitation requires only a low-privilege WordPress subscriber account - the lowest registered user role - making the attack surface broad on any membership-enabled site. The CVSS scope change (S:C) and high confidentiality impact (C:H) indicate that successful exploitation can expose data beyond the plugin itself, including sensitive user and order records stored in the WordPress database. No public exploit code or active exploitation has been identified at time of analysis.
Blind SQL injection in YITH WooCommerce Product Add-Ons (WordPress plugin) through version 4.29.0 allows high-privileged authenticated users to inject malicious SQL into database queries, leading to confidentiality compromise and limited availability impact across a changed security scope. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.6; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery.16.0. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization bypass in YITH WooCommerce Wishlist through version 4.12.0 allows unauthenticated remote attackers to modify wishlist data via user-controlled object references, exploiting improper access control validation. The vulnerability enables integrity attacks against wishlist functionality without requiring authentication or user interaction, affecting all WordPress installations using the vulnerable plugin.
Privilege escalation in YITH WooCommerce Waitlist Premium for WordPress (versions ≤3.35.0) allows any subscriber-level authenticated user to manufacture a new WordPress administrator account, achieving full site takeover. The vulnerable AJAX handler add_user_in_waiting_list() is exposed to all logged-in users with no nonce or capability check, and applies parse_str() plus extract() to attacker-supplied POST data before passing the injected variables directly to wp_create_user() and $user->set_role(). No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack mechanics are trivially derivable from the Wordfence disclosure.
Missing authorization in the YITH Request a Quote for WooCommerce Premium plugin (all versions before 4.46.0) lets unauthenticated attackers reach functionality that should be access-controlled, per a Patchstack advisory. The flaw is a broken-access-control / missing-authorization issue (CWE-862) rated CVSS 9.8; no public exploit identified at time of analysis, though the advisory does not detail the exact vulnerable action.
SQL injection in YITH WooCommerce Membership Premium versions 2.33.0 and below allows authenticated subscribers to execute arbitrary SQL queries against the underlying database. Exploitation requires only a low-privilege WordPress subscriber account - the lowest registered user role - making the attack surface broad on any membership-enabled site. The CVSS scope change (S:C) and high confidentiality impact (C:H) indicate that successful exploitation can expose data beyond the plugin itself, including sensitive user and order records stored in the WordPress database. No public exploit code or active exploitation has been identified at time of analysis.
Blind SQL injection in YITH WooCommerce Product Add-Ons (WordPress plugin) through version 4.29.0 allows high-privileged authenticated users to inject malicious SQL into database queries, leading to confidentiality compromise and limited availability impact across a changed security scope. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.6; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery.16.0. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization bypass in YITH WooCommerce Wishlist through version 4.12.0 allows unauthenticated remote attackers to modify wishlist data via user-controlled object references, exploiting improper access control validation. The vulnerability enables integrity attacks against wishlist functionality without requiring authentication or user interaction, affecting all WordPress installations using the vulnerable plugin.