CVE-2026-14359 Overview
CVE-2026-14359 is a privilege escalation vulnerability in the YITH WooCommerce Waitlist Premium plugin for WordPress. The flaw affects all versions up to and including 3.35.0. Authenticated attackers with Subscriber-level access can escalate to administrator by abusing the add_user_in_waiting_list() AJAX handler. The function is missing both a capability check and a nonce verification. It also uses parse_str() combined with extract() to import attacker-controlled variables from $_POST['params'], which are then passed to wp_create_user() and $user->set_role(). This enables an attacker to create a new administrator account on the target WordPress site.
Critical Impact
Any authenticated user with Subscriber privileges can create an administrator account, resulting in full site takeover.
Affected Products
- YITH WooCommerce Waitlist Premium plugin for WordPress
- All versions up to and including 3.35.0
- WordPress sites running WooCommerce with this plugin enabled
Discovery Timeline
- 2026-09-09 - CVE-2026-14359 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-14359
Vulnerability Analysis
The vulnerability resides in the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user AJAX action. Because the endpoint is exposed to any authenticated session, an attacker with Subscriber access can reach it. The handler neither verifies the caller's capabilities nor validates a nonce token. Attackers can therefore invoke the endpoint directly with crafted POST data.
The function parses the params POST parameter using parse_str() and then calls extract() on the resulting array. This pattern imports arbitrary variables into the local scope from attacker-controlled input. Those variables are subsequently forwarded to wp_create_user() and $user->set_role(), allowing the attacker to define the username, password, email, and role for the new account.
This flaw maps to CWE-269: Improper Privilege Management. Successful exploitation yields administrator-level access, which typically leads to arbitrary file upload, plugin/theme modification, and full site compromise.
Root Cause
Two compounding issues cause the vulnerability. First, the AJAX action lacks authorization controls, exposing privileged functionality to low-privileged users. Second, the use of parse_str() and extract() on untrusted input allows attacker-controlled variable injection, bypassing any implicit assumptions about parameter names or values passed to wp_create_user() and the role assignment call.
Attack Vector
An attacker first registers or obtains a Subscriber account, which many WordPress sites allow by default. The attacker then sends an authenticated POST request to /wp-admin/admin-ajax.php with action=yith_wcwtl_add_user and a params field containing a URL-encoded query string. The query string defines the target user_login, user_pass, user_email, and role values. The handler creates the account and assigns it the administrator role. See the Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2026-14359
Indicators of Compromise
- Unexpected new WordPress user accounts with the administrator role, especially created shortly after Subscriber account registrations.
- POST requests to /wp-admin/admin-ajax.php containing action=yith_wcwtl_add_user from non-administrative sessions.
- Entries in the wp_users and wp_usermeta tables referencing unknown administrator accounts.
- New plugins, themes, or PHP files uploaded shortly after suspicious account creation events.
Detection Strategies
- Monitor web server access logs for POST requests to admin-ajax.php with the yith_wcwtl_add_user action parameter.
- Alert on any WordPress user_register event followed by a role change to administrator within a short time window.
- Audit WordPress user tables regularly and compare against an approved administrator baseline.
- Deploy a web application firewall rule to inspect the params field of the vulnerable AJAX action for role assignment attempts.
Monitoring Recommendations
- Forward WordPress authentication and user management events to a centralized SIEM for correlation.
- Track outbound plugin installation and file modification activity following user creation events.
- Enable file integrity monitoring on the WordPress wp-content directory to detect follow-on malicious uploads.
How to Mitigate CVE-2026-14359
Immediate Actions Required
- Update the YITH WooCommerce Waitlist Premium plugin to a version newer than 3.35.0 as soon as a patched release is available from the vendor.
- Audit all WordPress administrator accounts and remove any that cannot be attributed to a legitimate user.
- Temporarily disable open user registration or restrict the default role for new registrations if the plugin cannot be updated immediately.
- Rotate credentials and secrets, including WordPress salts, for any site suspected of compromise.
Patch Information
The vendor maintains the plugin at YITH Themes. Administrators should apply the patched release addressing CVE-2026-14359 once published and confirm the fixed version through the WordPress plugin manager. Refer to the Wordfence Vulnerability Report for version tracking.
Workarounds
- Deactivate the YITH WooCommerce Waitlist Premium plugin until the patched version is installed.
- Add a web application firewall rule that blocks requests where action=yith_wcwtl_add_user originates from non-administrator sessions.
- Set the WordPress default registration role to Subscriber and disable open registration where possible via the Settings > General administration page.
- Restrict access to /wp-admin/admin-ajax.php from unauthenticated or low-reputation sources at the network edge.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
