medium6.5
CVE-2026-4432
The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wis…
Impact
The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.
Affected products
| Product | Affected versions |
|---|---|
| YITH WooCommerce Wishlist WordPress Plugin | before 4.13.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.