CVE-2026-14359: YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

Published Sep 9, 2026
·
Updated

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist() function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verification, and using parsestr() + extract() to import attacker-controlled variables from $POST['params'] that are then passed to wpcreateuser() and $user->setrole(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator by creating a new user account and assigning it the administrator role.

Affected Software

1 affected component
YITH WooCommerce Waitlist Premium (WordPress plugin)<=3.35.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade YITH WooCommerce Waitlist Premium (WordPress plugin) to a version that resolves this vulnerability.

    Fixed in 3.35.0
  2. Configuration

    Modify the wp_ajax_yith_wcwtl_add_user handler (add_user_in_waiting_list()) to include a capability check and nonce verification, and remove use of parse_str()/extract() on attacker-controlled $_POST['params'] prior to wp_create_user() and $user->set_role().

    WordPress (admin-ajax handler) for wp_ajax_yith_wcwtl_add_user in YITH WooCommerce Waitlist Premium Add authorization and nonce validation to add_user_in_waiting_list() = require capability check and nonce verification before processing $_POST['params']

Event History

Sep 9, 2026
CVE Published
via MITRE·08:28 AM
Data Sourced
via MITRE·08:28 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this vulnerability?

An attacker must be authenticated to the WordPress site with at least Subscriber-level access. No additional capability check or nonce verification is performed by the affected AJAX action.

2

What access could an attacker gain?

A qualifying authenticated attacker can create a new WordPress user account and assign it the administrator role. This can result in full confidentiality, integrity, and availability impact for the site.

3

Which plugin versions are affected?

YITH WooCommerce Waitlist Premium versions up to and including 3.35.0 are affected.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203