CVE WATCH / VULNERABILITY DETAIL
CVE-2026-124763
CRITICALCVSS 9.1NVD feed
Published 13 November 2026 · tracked since 13 November 2026
Description
The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-126293 MEDIUM 6.5
- CVE-2026-126285 HIGH 7.7
- CVE-2026-126268 MEDIUM 5.3
- CVE-2026-126029 MEDIUM 6.4
- CVE-2026-125948 MEDIUM 6.4
- CVE-2026-125409 MEDIUM 6.4
- CVE-2026-125055 CRITICAL 9.8
- CVE-2026-124218 HIGH 8.2
- CVE-2026-123769 HIGH 8.8
- CVE-2026-122227 MEDIUM 6.5