CVE-2026-4432: YITH WooCommerce Auth Bypass Vulnerability

CVE-2026-4432 Overview

CVE-2026-4432 is an authorization bypass vulnerability affecting the YITH WooCommerce Wishlist WordPress plugin before version 4.13.0. The vulnerability exists in the save_title() AJAX handler, which fails to properly validate wishlist ownership before allowing renaming operations. While the function checks for a valid nonce, this security token is publicly exposed in the page source of the /wishlist/ page, enabling unauthenticated attackers to rename any wishlist belonging to any user on the site.

Critical Impact

Unauthenticated attackers can manipulate wishlist names for any user by exploiting the publicly exposed nonce, potentially leading to defacement, phishing attacks, or reputation damage.

Affected Products

• YITH WooCommerce Wishlist plugin versions before 4.13.0
• WordPress installations using the vulnerable plugin versions
• WooCommerce stores with wishlist functionality enabled

Discovery Timeline

• April 10, 2026 - CVE-2026-4432 published to NVD
• April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4432

Vulnerability Analysis

This vulnerability represents a Broken Access Control flaw in the YITH WooCommerce Wishlist plugin's AJAX handling mechanism. The core issue stems from insufficient authorization checks in the save_title() function, which is responsible for processing wishlist renaming requests.

The plugin implements nonce verification as its primary security control for the AJAX endpoint. However, this approach is fundamentally flawed because the nonce token is embedded directly in the HTML source of the publicly accessible /wishlist/ page. Any visitor to the site can extract this nonce value and use it to authenticate their requests to the save_title() handler.

The absence of proper ownership validation means the function accepts any valid nonce without verifying whether the requesting user has permission to modify the targeted wishlist. This allows attackers to enumerate wishlist IDs and rename wishlists belonging to other users without authentication.

Root Cause

The root cause of CVE-2026-4432 is the reliance on nonce verification alone for authorization without implementing proper ownership checks. Nonces in WordPress are designed to protect against Cross-Site Request Forgery (CSRF) attacks by ensuring requests originate from legitimate site pages, but they are not intended to serve as the sole authorization mechanism. The save_title() function should have included additional checks to verify that the current user is the owner of the wishlist being modified or has administrative privileges to modify any wishlist.

Attack Vector

The attack can be executed remotely over the network without requiring any user interaction or authentication. An attacker follows this exploitation path:

1. The attacker visits the target WordPress site's /wishlist/ page
2. They extract the publicly visible nonce value from the page source
3. Using the extracted nonce, they craft a malicious POST request to the save_title() AJAX endpoint
4. The request includes the target wishlist ID and the desired new name
5. The server validates the nonce, finds it legitimate, and processes the rename operation without checking ownership
6. The wishlist is renamed regardless of the original owner

This vulnerability does not require authentication, making it exploitable by any internet user who can access the WordPress site.

Detection Methods for CVE-2026-4432

Indicators of Compromise

• Unusual volume of AJAX requests to the wishlist save_title() endpoint from single IP addresses
• Wishlist names changed to unexpected or malicious content (phishing URLs, defacement text)
• User complaints about wishlists being renamed without their action
• Web server logs showing POST requests to /wp-admin/admin-ajax.php with action=save_title from unauthenticated sessions

Detection Strategies

• Monitor WordPress AJAX endpoints for unusual request patterns targeting wishlist functions
• Implement Web Application Firewall (WAF) rules to detect and block suspicious save_title() requests
• Review access logs for repeated requests to the wishlist AJAX handler from non-authenticated users
• Deploy file integrity monitoring to detect unauthorized plugin modifications

Monitoring Recommendations

• Enable detailed WordPress audit logging to track all wishlist modification events
• Set up alerts for bulk wishlist name changes occurring in short time periods
• Monitor for enumeration patterns in wishlist ID parameters
• Implement rate limiting on AJAX endpoints to slow potential automated exploitation

How to Mitigate CVE-2026-4432

Immediate Actions Required

• Update YITH WooCommerce Wishlist plugin to version 4.13.0 or later immediately
• Review all existing wishlists for unauthorized name modifications
• Consider temporarily disabling the wishlist renaming feature if patching is not immediately possible
• Implement WAF rules to block unauthenticated requests to the save_title() AJAX handler

Patch Information

The vulnerability is addressed in YITH WooCommerce Wishlist version 4.13.0. The patch adds proper ownership validation to the save_title() function, ensuring that only the wishlist owner or site administrators can rename wishlists. Site administrators should update to this version through the WordPress admin panel or by manually uploading the updated plugin files.

For detailed vulnerability information, refer to the WPScan Vulnerability Report.

Workarounds

• Disable the wishlist renaming functionality by customizing the plugin or using hooks to remove the AJAX handler
• Implement server-level IP-based restrictions for the WordPress AJAX endpoint
• Deploy a WAF rule to require authentication for all wishlist-related AJAX actions
• Use WordPress capability checks via custom code to enforce authorization at the theme or child plugin level

# Example WAF rule configuration for ModSecurity
# Block unauthenticated requests to save_title AJAX handler
SecRule REQUEST_FILENAME "@contains admin-ajax.php" \
    "id:1001,phase:2,deny,status:403,\
    chain"
SecRule ARGS:action "@streq save_title" \
    "chain"
SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"