The YITH WooCommerce Wishlist plugin suffers from improper authorization (CWE-285) due to the REST API endpoint /wp-json/yith/wishlist/v1/lists using a permission callback that always returns true, and the AJAX delete_item handler only validating nonce without verifying object-level permissions. This enables unauthenticated attackers to retrieve wishlist tokens for any user and delete wishlist items by chaining these flaws. The issue affects all versions up to 4.10.0 and was publicly disclosed on 2025-11-19. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An unauthenticated attacker can bypass authorization controls to disclose wishlist tokens belonging to any user and delete wishlist items. This results in limited integrity impact by unauthorized modification of wishlist data. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or restricting access to the vulnerable REST API and AJAX endpoints through other means such as web application firewall rules or custom code to enforce proper authorization checks.