WordPress Plugin Vulnerabilities

YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion

Description

The plugin does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users.

Proof of Concept

Affects Plugins

Plugin icon
yith-woocommerce-popup
Fixed in 1.60.0

References

CVE
CVE-2026-92426

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
4.9 (medium)

Miscellaneous

Original Researcher
JunHee CHO
Submitter
JunHee CHO
Submitter website
https://github.com/jun2e0
Verified
Yes
WPVDB ID
202f347c-962d-47a9-9dbd-70a20893db69

Timeline

Publicly Published
2026-10-12 (about 2 days ago)
Added
2026-10-12 (about 1 day ago)
Last Updated
2026-10-12 (about 1 day ago)

Other

Published
Title
Published
2026-08-25
Title
JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download
Published
2021-09-29
Title
Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image Upload
Published
2026-07-28
Title
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation
Published
2024-05-22
Title
EmbedPress < 3.9.13 - Contributor+ PDF Block Embedding
Published
2025-08-15
Title
OceanWP < 4.1.2 - Subscriber+ Limited Option Update