CVE-2026-27329 MEDIUM

CVE-2026-27329: WordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability

Vendor Yith
Product YITH WooCommerce Wishlist
Weakness CWE-639 · IDOR
Published May 7, 2026
Last update May 7, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Wishlist: from n/a through 4.12.0.

Explanation of Vulnerability in Simple Terms

02Summary

YITH WooCommerce Wishlist versions up to 4.12.0 contain an integrity vulnerability allowing unauthenticated attackers to modify data over the network without user interaction. The vulnerability has a CVSS score of 5.3 (medium severity). No confidentiality or availability impact is present. Update to a version newer than 4.12.0 to remediate.

What an attacker can do

03Attacker Capabilities

Modify wishlist data or related information without authentication.

Potential impact on your site

04Site Impact

Wishlist data integrity cannot be guaranteed; attackers can alter customer wishlists without logging in.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

May 7, 2026 CVE published
May 7, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-6206 MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter CVE-2026-7648 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter CVE-2026-8839 MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints CVE-2026-57341 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.9.0 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-11987 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter