CVE-2026-4432 | YITH WooCommerce Wishlist Plugin up to 4.12.x on WordPress AJAX /wishlist/ save_title authorization

A vulnerability was found in YITH WooCommerce Wishlist Plugin up to 4.12.x on WordPress. It has been rated as critical. Affected by this issue is the function save_title of the file /wishlist/ of the component AJAX Handler. This manipulation causes missing authorization.

This vulnerability is tracked as CVE-2026-4432. The attack is possible to be carried out remotely. No exploit exists.

Upgrading the affected component is advised.