CVE-2026-4432: YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR
The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the savetitle() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4432?
CVE-2026-4432 has a medium severity rating due to the potential for unauthorized wishlist renaming.
How do I fix CVE-2026-4432?
To fix CVE-2026-4432, update the YITH WooCommerce Wishlist plugin to version 4.13.0 or later.
What kind of vulnerability is CVE-2026-4432?
CVE-2026-4432 is an unauthenticated arbitrary wishlist renaming vulnerability caused by improper validation.
Who is affected by CVE-2026-4432?
Users of YITH WooCommerce Wishlist versions prior to 4.13.0 are affected by CVE-2026-4432.
Can CVE-2026-4432 lead to data loss?
CVE-2026-4432 could potentially lead to unauthorized modifications of wishlist data, impacting integrity.