CVE-2026-14359— YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user
Quick assessment
Affected
Yith YITH WooCommerce Waitlist Premium
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 YITH WooCommerce Waitlist Premium 插件存在权限提升漏洞，受影响版本为 3.35.0 及之前版本。该漏洞原因是：注册在 动作上的 函数既缺少权限（capability）检查，也缺少 nonce 校验，并且使用 + 从 中导入攻击者可控的变量，这些变量随后会被传递给 和 。这使得拥有 Subscriber（订阅者）及以上权限的已认证攻击者能够创建新的用户账户并将其角色设置为管理员，从而将自身权限提升至管理员级别。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14359
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user
Source: CVE Program / CVE List V5
Vulnerability Description
The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST['params'] that are then passed to wp_create_user() and $user->set_role(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator by creating a new user account and assigning it the administrator role.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Yith | YITH WooCommerce Waitlist Premium | 0 ~ 3.35.0 | - |
|
II. Public POCs for CVE-2026-14359
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14359
请登录查看更多情报信息。
Other References for CVE-2026-14359 (2)
IV. Related Vulnerabilities
Same vendor: Yith
-
CVE-2026-84238
WordPress YITH Request a Quote for WooCommerce Premium plugi -
CVE-2026-32552
WordPress YITH WooCommerce Membership Premium plugin <= 2.33 -
CVE-2022-44630
WordPress YITH WooCommerce Product Slider Carousel plugin <= -
CVE-2026-42383
WordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 -
CVE-2026-27329
WordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insec
Same weakness: CWE-269
-
CVE-2026-12858
Local privilege escalation vulnerability in ESET AV Remover -
CVE-2026-75927
PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+ -
CVE-2026-17553
Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (St -
CVE-2026-76801
FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Exec -
CVE-2026-66818
Microsoft SQL Server Elevation of Privilege Vulnerability
V. Comments for CVE-2026-14359
No comments yet