CVE-2026-27329
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The YITH WooCommerce Wishlist plugin up to version 4.12.0 contains an authorization bypass through a user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker could gain access to functionality or data they are not authorized for, potentially leading to disclosure or modification of data in the WooCommerce store.
Recommendation
Update the YITH WooCommerce Wishlist plugin to a version newer than 4.12.0 if available, or implement additional access controls.
Other vulnerabilities in YITH WooCommerce Wishlist
See all- CVE-2026-112199Medium
The YITH WooCommerce Wishlist plugin up to version 4.18.1 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.
- CVE-2025-12427Medium
The YITH WooCommerce Wishlist plugin for WordPress in all versions up to and including 4.10.0 is vulnerable to Insecure Direct Object Reference via the REST API endpoint and AJAX handler due to missing validation on user-controlled keys. This allows unauthenticated attackers to discover any user's wishlist token ID and subsequently rename the victim's wishlist without authorization.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Wishlist: from n/a through 4.12.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS