Yith Woocommerce Popup
Monthly
Authenticated users holding the WordPress Contributor role or higher can delete arbitrary post meta on any post - including content owned by administrators and other higher-privileged users - on sites running the YITH WooCommerce Popup plugin before version 1.60.0, because the plugin fails to verify the requester's capability before performing the deletion. The impact is integrity-only (no confidentiality or availability loss, no code execution), and while publicly available exploit code exists, EPSS is low at 0.16% and there is no CISA KEV confirmation of active exploitation. The vendor has released a fixed version (1.60.0).
Authenticated users holding the WordPress Contributor role or higher can delete arbitrary post meta on any post - including content owned by administrators and other higher-privileged users - on sites running the YITH WooCommerce Popup plugin before version 1.60.0, because the plugin fails to verify the requester's capability before performing the deletion. The impact is integrity-only (no confidentiality or availability loss, no code execution), and while publicly available exploit code exists, EPSS is low at 0.16% and there is no CISA KEV confirmation of active exploitation. The vendor has released a fixed version (1.60.0).