CVE-2026-82305

MediumCVSS 5.3

Published: 11/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 11/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist. This allows unauthenticated users to rename any wishlist on the site.

Risk Assessment

An unauthenticated attacker can modify the names of all users' wishlists, compromising data integrity and potentially enabling phishing or disinformation. This undermines trust in the store's wishlist functionality.

Recommendation

Update the YITH WooCommerce Wishlist plugin to version 4.18.1 or later. Until then, consider disabling the wishlist rename feature.

Other vulnerabilities in YITH WooCommerce Wishlist WordPress plugin

CVE-2025-12777Medium
The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This is due to the plugin not properly verifying that a user is authorized to perform actions on the REST API /wp-json/yith/wishlist/v1/lists endpoint (which uses permission_callback => '__return_true') and the AJAX delete_item handler (which only checks nonce validity without verifying object-level authorization). This makes it possible for unauthenticated attackers to disclose wishlist tokens for any user and subsequently delete wishlist items by chaining the REST API authorization bypass with the exposed delete_item nonce on shared wishlist pages and the AJAX handler's missing object-level authorization check.

Original NVD description (English source)

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS