CVE-2026-124763
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 13, 2026
Vendor
unknown
Description
The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).