CVE-2026-4432 YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR
Unauthenticated attackers can rename any user's wishlist due to missing ownership validation in the save_title AJAX handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-4432?
CVE-2026-4432 is a medium-severity missing authorization vulnerability in Unknown YITH WooCommerce Wishlist, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.
Which versions are affected by CVE-2026-4432?
How do I fix CVE-2026-4432?
No fix has been published for CVE-2026-4432 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-4432 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-4432 exists.
Sources
Also known as GHSA-r2fc-mm5p-v3mp.