Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-10 | 1 | Disclosure1 |
| 2026-04-11 | 1 | General1 |
⚡ New CVE Alert: CVE-2026-4432 🚨 Risk Level: Unknown 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4432 #CVE-2026-4432 #CVE #Wordpress #CyberSecurity #InfoSec https://t.co/oEiFhcrqUU
Post summary
The tweet announces new CVE-2026-4432, notes its unknown risk level, and links to the NVD entry, but provides no technical or exploit details.
CVE-2026-4432 The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist ren… https://www.cve.org/CVERecord?id=CVE-2026-4432
Post summary
The text announces CVE-2026-4432, indicating that YITH WooCommerce Wishlist plugin inadvertently permits unauthorized wishlist title changes due to improper ownership validation in an AJAX handler.