by Kastro
Paper/Archive/CVE-2026-124763

CVE-2026-124763

Unknown Woocommerce Wishlist — AM Wishlist <= 1.1.0 - Unauthenticated Option Overwrite via amwl_upload_file

EPSS 0.1%CVSS 9.1
critical.is priorityof 100
28
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 0.9.009 × 200.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).

Affected

ProductAffectedFixed inSource
Woocommerce Wishlist≤ 1.1.0–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

exploitwpscan.com/vulnerability/557b9f2b-4673-4efb-b7a5-f68c0b2222ac