Dashboard / CVE-2026-124763

CVE-2026-124763

CRITICAL
INFO Priority: 0.01 BB Relevance: 78/100
Published: 2026-11-13 Modified: 2026-11-13 First seen: 2026-11-13 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: None
I: High
A: High

Description

The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Unknown Woocommerce Wishlist 0
Unknown Woocommerce Wishlist 0

References & Advisories (1)

Bug Bounty Relevance

78 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS — Exploitation Probability

0.15%
Raw Score 0.001550
Percentile 4.7%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00155
2026-11-13
0.00100

Intelligence Sources

mitre ref →
nvd ref →

External Links