Vulnerability record/PUBLISHED/Published Nov 13, 2026 06:00:08 UTC
CVE-2026-124763
The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 13, 2026 06:00:08 UTC
PublishedNov 13, 2026 06:00:08 UTC
ReservedNov 9, 2026 12:50:51 UTC
Credits
- Usama Arshad
- WPScan