CVE-2026-92426 YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion
Contributors can delete arbitrary post meta from any post due to missing capability checks in the YITH WooCommerce Popup plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92426?
CVE-2026-92426 is a medium-severity missing authorization vulnerability in Unknown YITH WooCommerce Popup, published on 14 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users.
Weakness: CWE-863
Which versions are affected by CVE-2026-92426?
How do I fix CVE-2026-92426?
No fix has been published for CVE-2026-92426 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-92426 being exploited?
There is no known exploitation of CVE-2026-92426 in the wild and no public exploit code.
Sources
Also known as GHSA-6j75-vpg8-hjrh.