CVE-2026-92426: YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion

Q: Who can exploit this issue?

A user with the Contributor role or any higher-privileged role can exploit it. The affected plugin does not verify that the requesting user has the required capability before deleting post metadata.

Q: What can an attacker delete?

An attacker can delete arbitrary post metadata from any post, including posts owned by users with higher privileges. This can affect metadata associated with content the attacker does not own.

Q: Which plugin versions are affected?

Versions of YITH WooCommerce Popup before 1.60.0 are affected. Updating to version 1.60.0 or later addresses the affected version range.

Published Oct 14, 2026

Updated

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users.

Affected Software

1 affected component

YITH WooCommerce Popup<1.60.0

Event History

Oct 14, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with the Contributor role or any higher-privileged role can exploit it. The affected plugin does not verify that the requesting user has the required capability before deleting post metadata.

What can an attacker delete?

An attacker can delete arbitrary post metadata from any post, including posts owned by users with higher privileges. This can affect metadata associated with content the attacker does not own.

Which plugin versions are affected?

Versions of YITH WooCommerce Popup before 1.60.0 are affected. Updating to version 1.60.0 or later addresses the affected version range.