CVE-2026-14359: YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user
The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist() function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verification, and using parsestr() + extract() to import attacker-controlled variables from $POST['params'] that are then passed to wpcreateuser() and $user->setrole(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator by creating a new user account and assigning it the administrator role.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YITH WooCommerce Waitlist Premium (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.35.0 - Configuration
Modify the wp_ajax_yith_wcwtl_add_user handler (add_user_in_waiting_list()) to include a capability check and nonce verification, and remove use of parse_str()/extract() on attacker-controlled $_POST['params'] prior to wp_create_user() and $user->set_role().
WordPress (admin-ajax handler) for wp_ajax_yith_wcwtl_add_user in YITH WooCommerce Waitlist Premium Add authorization and nonce validation to add_user_in_waiting_list() = require capability check and nonce verification before processing $_POST['params']
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to the WordPress site with at least Subscriber-level access. No additional capability check or nonce verification is performed by the affected AJAX action.
What access could an attacker gain?
A qualifying authenticated attacker can create a new WordPress user account and assign it the administrator role. This can result in full confidentiality, integrity, and availability impact for the site.
Which plugin versions are affected?
YITH WooCommerce Waitlist Premium versions up to and including 3.35.0 are affected.