CVE-2026-124763

{
  "etk_id": "ETK-2026-4365",
  "cve_id": "CVE-2026-124763",
  "display_id": "CVE-2026-124763",
  "ghsa_id": "GHSA-9c3x-hc2h-94xp",
  "euvd_id": "EUVD-2026-124849",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated option overwrite in WooCommerce Wishlist",
  "summary": "WooCommerce Wishlist through version 1.1.0 includes an AJAX operation that does not enforce authorization or CSRF validation. An unauthenticated attacker able to reach that operation may change site option values, potentially disrupting site configuration or functionality.",
  "mitigation": "Disable or remove WooCommerce Wishlist 1.1.0 and earlier where possible until a vendor update is available. Otherwise, restrict unauthenticated access to the affected AJAX operation with web-server or application-layer controls.",
  "vendor": null,
  "product": "Woocommerce Wishlist",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Woocommerce Wishlist",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 9.1,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 38.1891351,
  "t0_at": "2026-11-13T06:00:08.945000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-13T06:00:08.945000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T06:00:08.945000+00:00",
      "url": "https://github.com/advisories/GHSA-9c3x-hc2h-94xp"
    }
  }
}