Vulnerability · Published Apr 10, 2026 · Assigned by WPScan
CVE-2026-4432YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR
Medium 6.5
In plain English
A medium-severity security flaw in YITH WooCommerce Wishlist from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 86.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | YITH WooCommerce Wishlist | 0 – before 4.13.0 |
References
- https://wpscan.com/vulnerability/2f052086-b691-48df-9b08-2cb1db65e14e/ exploit, vdb-entry, technical-description