WordPress Plugin Vulnerabilities

YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title

Description

The plugin does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site.

Proof of Concept

Affects Plugins

Plugin icon
yith-woocommerce-wishlist
Fixed in 4.18.1

References

CVE
CVE-2026-82305

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Abdullah Kareem
Submitter
Abdullah Kareem
Submitter website
https://cyberkareem.com
Submitter twitter
cyberkareem
Verified
Yes
WPVDB ID
2a0a8762-582d-41ae-bb85-a1e906be811a

Timeline

Publicly Published
2026-09-09 (about 2 days ago)
Added
2026-09-09 (about 1 day ago)
Last Updated
2026-09-09 (about 1 day ago)

Other

Published
Title
Published
2022-09-19
Title
Booster for WooCommerce - Subscriber+ Order Status Update
Published
2020-12-28
Title
WooCommerce < 4.7.0 - Arbitrary Order Status Disclosure via IDOR
Published
2024-03-28
Title
ProfileGrid < 5.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-01-01
Title
Branda – White Label & Branding, Free Login Page Customizer < 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover
Published
2026-02-13
Title
Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification