CVE-2026-124763criticalCWE-862

CVE-2026-124763: fallo crítico en Woocommerce Wishlist

AM Wishlist <= 1.1.0 - Unauthenticated Option Overwrite via amwl_upload_file

Publicada el

Seguir esta CVE+ Monitorear Wishlist

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

25Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1
The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Productos afectados
Unknown · Woocommerce Wishlist