CVE-2026-107868
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The YITH WooCommerce Product Add-Ons plugin in versions up to 4.34.0 contains an unauthenticated bypass vulnerability. The description does not specify the mechanism, but indicates a bypass flaw exploitable without authentication.
Risk Assessment
An unauthenticated attacker may bypass security controls in the WooCommerce store, potentially leading to unauthorized actions on the site. The risk applies to any installation of the plugin at version 4.34.0 or earlier.
Recommendation
Update the YITH WooCommerce Product Add-Ons plugin to a version newer than 4.34.0. Until patched, consider disabling the plugin or restricting access to the store.
Other vulnerabilities in YITH WooCommerce Product Add-Ons
See all- CVE-2026-66480Medium
The YITH WooCommerce Product Add-Ons plugin up to version 4.34.0 exposes sensitive system information to unauthorized parties. The flaw allows retrieval of embedded sensitive data.
- CVE-2026-42383High
The YITH WooCommerce Product Add-Ons plugin up to version 4.29.0 contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.
Original NVD description (English source)
Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS