CVE-2026-82305: YITH WooCommerce Wishlist Auth Bypass Flaw

CVE-2026-82305 Overview

CVE-2026-82305 is a broken access control vulnerability in the YITH WooCommerce Wishlist WordPress plugin before version 4.18.1. The plugin fails to verify whether a user is authorized to rename a given wishlist. Unauthenticated attackers can rename any wishlist on an affected site by sending crafted requests over the network. The issue is classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact

Unauthenticated attackers can modify wishlist names belonging to any user, resulting in unauthorized data tampering across all WooCommerce stores running the vulnerable plugin.

Affected Products

• YITH WooCommerce Wishlist WordPress plugin versions prior to 4.18.1
• WordPress sites running WooCommerce with the affected plugin
• E-commerce stores using YITH Wishlist for customer product lists

Discovery Timeline

• 2026-09-11 - CVE-2026-82305 published to the National Vulnerability Database
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-82305

Vulnerability Analysis

The YITH WooCommerce Wishlist plugin exposes a wishlist rename operation without enforcing an authorization check. The endpoint accepts a wishlist identifier and a new name, then applies the change without confirming that the requester owns the target wishlist or holds an equivalent privilege. Because the plugin also does not require authentication for this action, any anonymous visitor can invoke it.

The impact is limited to integrity of wishlist metadata. Attackers cannot read wishlist contents or disrupt site availability through this flaw alone. However, at scale, an attacker can rename every wishlist on a store, injecting arbitrary strings into customer-facing labels and administrative views.

Root Cause

The root cause is missing authorization logic on the wishlist rename handler. The plugin trusts a user-supplied wishlist identifier and processes the request without validating ownership against the current session or a capability check. This pattern matches [CWE-639], where access to resources is controlled solely by a predictable or user-supplied key.

Attack Vector

Exploitation occurs over the network with no authentication and no user interaction. An attacker sends an HTTP request to the plugin's rename endpoint, supplying the target wishlist ID and the desired new name. The server processes the request as if it were legitimate. Refer to the WPScan Vulnerability Report for the specific request parameters and endpoint used.

Detection Methods for CVE-2026-82305

Indicators of Compromise

• Wishlist names containing unexpected text, promotional content, defacement strings, or non-ASCII characters unrelated to product descriptions
• Multiple wishlist rename events originating from a single IP address or user agent within a short time window
• Rename requests where the session user does not match the wishlist owner in database records

Detection Strategies

• Review web server access logs for POST or AJAX requests targeting YITH Wishlist rename actions from unauthenticated sessions
• Query the WordPress database for recent modifications to wishlist name fields and cross-reference against expected owner activity
• Enable WordPress audit logging plugins to capture wishlist modification events with actor context

Monitoring Recommendations

• Alert on bursts of wishlist rename operations exceeding normal customer behavior baselines
• Monitor for requests to the vulnerable endpoint originating from IP addresses without a valid authenticated session cookie
• Track plugin version inventory across WordPress deployments to identify unpatched instances

How to Mitigate CVE-2026-82305

Immediate Actions Required

• Update the YITH WooCommerce Wishlist plugin to version 4.18.1 or later on all WordPress installations
• Audit existing wishlists for unauthorized name changes and restore legitimate values from backups where needed
• Restrict access to the plugin's AJAX endpoints at the web application firewall until patching is complete

Patch Information

The vendor addressed CVE-2026-82305 in YITH WooCommerce Wishlist version 4.18.1. The fix introduces an authorization check that validates wishlist ownership before permitting a rename operation. Site administrators should apply the update through the WordPress plugin manager. Consult the WPScan Vulnerability Report for advisory details.

Workarounds

• Deploy a web application firewall rule that blocks unauthenticated POST requests to the wishlist rename action
• Temporarily disable the YITH WooCommerce Wishlist plugin on production stores if patching cannot be completed promptly
• Require authentication for all wishlist operations by enforcing login-only access to WooCommerce account features

# Example WP-CLI command to update the plugin
wp plugin update yith-woocommerce-wishlist --version=4.18.1