What the vulnerability does
01Description
The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This is due to the plugin not properly verifying that a user is authorized to perform actions on the REST API /wp-json/yith/wishlist/v1/lists endpoint (which uses permission_callback => '__return_true') and the AJAX delete_item handler (which only checks nonce validity without verifying object-level authorization). This makes it possible for unauthenticated attackers to disclose wishlist tokens for any user and subsequently delete wishlist items by chaining the REST API authorization bypass with the exposed delete_item nonce on shared wishlist pages and the AJAX handler's missing object-level authorization check.
Explanation of Vulnerability in Simple Terms
02Summary
YITH WooCommerce Wishlist versions up to 4.10.0 contain an integrity vulnerability that allows unauthenticated attackers to modify data over the network without user interaction. The vulnerability stems from insufficient access controls (CWE-285). Site administrators should update to a version newer than 4.10.0 to remediate the issue.
What an attacker can do
03Attacker Capabilities
Modify wishlist data or other plugin functionality without authentication.
Potential impact on your site
04Site Impact
Wishlist data integrity compromised; attackers can alter customer wishlists or plugin settings remotely.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
November 19, 2025
CVE published
April 8, 2026
Record updated
