CVE-2026-14359 affects the YITH WooCommerce Waitlist Premium WordPress plugin up to version 3.35.0. The vulnerability is due to the add_user_in_waiting_list() function being registered on the wp_ajax_yith_wcwtl_add_user action without proper capability checks or nonce verification. It uses parse_str() and extract() on attacker-controlled $_POST['params'], which are then passed to wp_create_user() and $user->set_role(). This allows authenticated users with low privileges to escalate their privileges to administrator by creating a new admin user account.

An authenticated attacker with Subscriber-level access or higher can exploit this vulnerability to create new user accounts with administrator privileges. This results in full administrative control over the affected WordPress site, leading to complete compromise of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.