The YITH WooCommerce Wishlist plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 4.10.0. This flaw allows unauthenticated attackers to access the REST API endpoint and AJAX handlers without proper permission checks, enabling disclosure of wishlist tokens and deletion of wishlist items across users.