CVE-2026-124763: AM Wishlist <= 1.1.0 - Unauthenticated Option Overwrite via amwl_upload_file
The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user can invoke the affected AJAX action. No login, authorization, or CSRF token is required.
What can an attacker change?
An attacker can overwrite arbitrary site options with the URL of an uploaded image or with an empty value. This can disrupt the site, including by changing its URL or deactivating plugins.
Are sites affected by default?
The issue is present in the plugin through version 1.1.0 because the affected unauthenticated AJAX action lacks authorization and CSRF checks. The provided information does not identify any configuration prerequisite.