Yith Woocommerce Wishlist
Monthly
Missing authorization on the wishlist rename endpoint in YITH WooCommerce Wishlist (WordPress plugin before 4.18.1) permits any unauthenticated network attacker to rename any customer wishlist sitewide by supplying a target wishlist identifier. The flaw is rooted in CWE-639 - the plugin never verifies that the requesting user owns or has permission over the wishlist identified by a user-controlled key. A publicly available proof-of-concept exists via WPScan; no active exploitation (KEV) has been confirmed. CVSS rates impact at 5.3 (I:L) as only wishlist names - not data, credentials, or site availability - are affected.
Authorization bypass in YITH WooCommerce Wishlist through version 4.12.0 allows unauthenticated remote attackers to modify wishlist data via user-controlled object references, exploiting improper access control validation. The vulnerability enables integrity attacks against wishlist functionality without requiring authentication or user interaction, affecting all WordPress installations using the vulnerable plugin.
Unauthenticated attackers can rename arbitrary wishlists on WordPress sites running YITH WooCommerce Wishlist before version 4.13.0 due to insufficient ownership validation in the save_title() AJAX handler. The vulnerability exploits a publicly exposed nonce in the wishlist page source, allowing attackers to modify wishlist names for any user without authentication. While the CVSS score of 6.5 reflects moderate integrity and confidentiality impact, the EPSS score of 0.02% (percentile 6%) and low real-world exploitation probability suggest this is a niche risk affecting only sites using this specific plugin, though publicly available exploit code exists.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization on the wishlist rename endpoint in YITH WooCommerce Wishlist (WordPress plugin before 4.18.1) permits any unauthenticated network attacker to rename any customer wishlist sitewide by supplying a target wishlist identifier. The flaw is rooted in CWE-639 - the plugin never verifies that the requesting user owns or has permission over the wishlist identified by a user-controlled key. A publicly available proof-of-concept exists via WPScan; no active exploitation (KEV) has been confirmed. CVSS rates impact at 5.3 (I:L) as only wishlist names - not data, credentials, or site availability - are affected.
Authorization bypass in YITH WooCommerce Wishlist through version 4.12.0 allows unauthenticated remote attackers to modify wishlist data via user-controlled object references, exploiting improper access control validation. The vulnerability enables integrity attacks against wishlist functionality without requiring authentication or user interaction, affecting all WordPress installations using the vulnerable plugin.
Unauthenticated attackers can rename arbitrary wishlists on WordPress sites running YITH WooCommerce Wishlist before version 4.13.0 due to insufficient ownership validation in the save_title() AJAX handler. The vulnerability exploits a publicly exposed nonce in the wishlist page source, allowing attackers to modify wishlist names for any user without authentication. While the CVSS score of 6.5 reflects moderate integrity and confidentiality impact, the EPSS score of 0.02% (percentile 6%) and low real-world exploitation probability suggest this is a niche risk affecting only sites using this specific plugin, though publicly available exploit code exists.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.