CVE-2026-124763criticalCWE-862

CVE-2026-124763: critical vulnerability in Woocommerce Wishlist

AM Wishlist <= 1.1.0 - Unauthenticated Option Overwrite via amwl_upload_file

Published

Follow this CVE+ Monitor Wishlist

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1
The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected products
Unknown · Woocommerce Wishlist