The YITH WooCommerce Wishlist plugin prior to version 4.13.0 contains a missing authorization vulnerability (CWE-862) in its save_title() AJAX handler. The handler verifies only a nonce, which is publicly accessible in the page source of the /wishlist/ page, but does not confirm that the requester owns the wishlist being renamed. This allows unauthenticated attackers to rename any wishlist belonging to any user on the site by exploiting the exposed nonce and the lack of ownership validation.

An attacker can rename any user's wishlist without authentication, potentially causing confusion or disruption for users relying on wishlist data. The confidentiality and integrity of wishlist titles are impacted, but there is no indication of availability impact or broader system compromise. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's updates and apply the official fix once available. Until then, consider restricting access to the wishlist page or implementing additional access controls to limit exposure.