CVE-2026-124763criticalCWE-862

CVE-2026-124763: falha crítica em Woocommerce Wishlist

AM Wishlist <= 1.1.0 - Unauthenticated Option Overwrite via amwl_upload_file

Publicada em

Seguir esta CVE+ Monitorar Wishlist

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

25Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1
The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
Unknown · Woocommerce Wishlist