CVE-2026-4432

CVE-2026-4432 concerns the YITH WooCommerce Wishlist WordPress plugin prior to 4.13.0. Publicly exposed nonce in the /wishlist page allows unauthenticated attackers to rename any wishlist, due to insufficient ownership validation in the save_title() AJAX handler. Technical details across connecte...