CVE-2026-27329 Overview
CVE-2026-27329 is an Insecure Direct Object Reference (IDOR) vulnerability in the YITH WooCommerce Wishlist plugin for WordPress. The flaw stems from incorrectly configured access control that allows attackers to manipulate user-controlled keys to access wishlist resources belonging to other users. The vulnerability is classified under [CWE-639] (Authorization Bypass Through User-Controlled Key) and affects all versions of YITH WooCommerce Wishlist up to and including 4.12.0. An unauthenticated attacker can exploit this issue over the network without user interaction, leading to limited integrity impact on stored wishlist data.
Critical Impact
Unauthenticated network attackers can bypass authorization controls and modify wishlist objects belonging to other users by manipulating predictable identifiers in requests.
Affected Products
- YITH WooCommerce Wishlist plugin for WordPress
- All versions from initial release through 4.12.0
- WordPress sites running WooCommerce with YITH Wishlist enabled
Discovery Timeline
- 2026-05-07 - CVE-2026-27329 published to NVD
- 2026-05-07 - Last updated in NVD database
Technical Details for CVE-2026-27329
Vulnerability Analysis
The vulnerability resides in the YITH WooCommerce Wishlist plugin's handling of object references. The plugin accepts user-supplied identifiers without verifying that the requesting user owns or has permission to access the referenced wishlist object. This pattern matches the classic Insecure Direct Object Reference (IDOR) anti-pattern. An attacker who substitutes a different user's wishlist identifier in a request can interact with that wishlist as if authorized.
The attack vector is network-based with low complexity and requires no authentication or user interaction. The integrity impact is limited because the attacker cannot escalate to arbitrary code execution or full account takeover. Confidentiality and availability are not directly affected by the flaw.
Root Cause
The root cause is missing or insufficient authorization checks within the plugin's request-handling logic. The application trusts the wishlist identifier provided in the request and performs operations against it without validating the relationship between the identifier and the current session. Access control decisions rely on the presence of a parameter rather than a verified ownership check against the database.
Attack Vector
An attacker sends crafted HTTP requests to the WordPress site containing wishlist identifiers belonging to other users. Because identifiers are predictable or enumerable, the attacker iterates through values to locate accessible wishlists. The plugin processes the requests without verifying ownership, allowing unauthorized modification of wishlist contents. Exploitation requires only HTTP access to the target WordPress instance.
For technical details, see the Patchstack Vulnerability Report.
Detection Methods for CVE-2026-27329
Indicators of Compromise
- Unusual sequential or enumerated wishlist IDs appearing in HTTP request logs against wp-admin/admin-ajax.php or wishlist endpoints.
- Requests originating from a single IP address targeting multiple distinct wishlist identifiers in rapid succession.
- Unauthenticated requests modifying wishlist objects associated with registered user accounts.
Detection Strategies
- Inspect WordPress access logs for repeated requests to YITH Wishlist action handlers with varying numeric ID parameters.
- Correlate session identity with the owner of the targeted wishlist object to identify mismatched access attempts.
- Deploy a web application firewall (WAF) rule to flag IDOR-style enumeration patterns against wishlist endpoints.
Monitoring Recommendations
- Enable verbose logging on the WooCommerce and YITH plugin endpoints to capture request parameters and source IPs.
- Monitor database changes to wishlist tables (yith_wcwl_*) for modifications not tied to the corresponding user session.
- Alert on unauthenticated requests that result in successful state changes to user-owned objects.
How to Mitigate CVE-2026-27329
Immediate Actions Required
- Update the YITH WooCommerce Wishlist plugin to a version released after 4.12.0 that addresses this issue.
- Audit existing wishlist data for unauthorized modifications introduced before patching.
- Restrict access to the WordPress admin and AJAX endpoints behind a WAF capable of inspecting parameter manipulation.
Patch Information
The vendor has released information about this vulnerability through Patchstack. Administrators should consult the Patchstack Vulnerability Report for the fixed version and apply the update through the WordPress plugin manager. Versions through 4.12.0 are vulnerable.
Workarounds
- Temporarily disable the YITH WooCommerce Wishlist plugin if patching is not immediately possible.
- Apply WAF virtual patching rules that validate ownership of wishlist identifiers in requests.
- Restrict wishlist functionality to authenticated users only and require nonce validation on state-changing operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
