CRITICALCVSS v3.1 9.1Vulnerability
CVE-2026-124763
The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).
Properties
- Severity
- CRITICAL
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Cvss severity
- CRITICAL
- Cvss score
- 9.1
- Epss score
- 0.001
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Last source
- FIRST EPSS
- Score
- 9.1
- Cvss version
- 3.1
- Cve id
- CVE-2026-124763
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- First seen by Signal
- 2026-11-13T08:17:28+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Published at
- 2026-11-13T06:16:53.870
- Last modified
- 2026-11-13T19:19:22.197
- Epss percentile
- 0.00867
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph