External risk intelligence

WooCommerce Wishlist WordPress Plugin Site Option Overwrite Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-124763

The vulnerability resides in a WordPress plugin used for web-facing functionality. Because this plugin operates within the context of a public-facing web application, the affected AJAX action is reachable from the internet by default, making it a commonly exposed component in standard web deployments.

Cross-site Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in a popular e-commerce plugin for WordPress allows unauthenticated attackers to disrupt website functionality by altering core settings, potentially including changing the site's address or disabling essential features. The exposure is external, meaning it's reachable over the internet.

Unauthenticated attackers can break websites.
Matters for online sales and site availability.
Confirm plugin relevance and exposure status.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can compromise a website by exploiting a flaw in the Woocommerce Wishlist WordPress plugin. This flaw allows them to alter critical site settings, potentially disabling the site or even redirecting it to a malicious URL by overwriting existing options with an image URL or an empty value.

No authentication required.
Triggers via unauthenticated AJAX action.
Site settings can be overwritten.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated users to alter critical website settings by overwriting site options. When supported by the advisory, this could lead to a complete site breakdown, including the deactivation of the plugin itself, by manipulating settings such as the site URL or active plugins.

Site options and configuration data.
Via unauthenticated AJAX actions.
Site breakage and plugin deactivation.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WooCommerce Wishlist WordPress plugin's lack of authorization and CSRF checks in unauthenticated AJAX actions presents a critical risk. Website owners and administrators are primarily responsible for addressing this vulnerability. The first step is to identify all instances of the affected plugin, confirm their online exposure, and assess business criticality to prioritize remediation efforts.

Website owners and administrators should own the issue.
Verify plugin presence and external reachability first.
Plan remediation or temporary risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WooCommerce Wishlist WordPress plugin?

It is a WordPress extension designed to help e-commerce store visitors save items to a personal list for later purchase. It integrates directly with WooCommerce to manage user-specific wishlist data, often providing public-facing buttons and interface components on product pages to enhance the shopping experience.

How does CVE-2026-124763 affect my WordPress site?

This vulnerability is classified as CWE-862, or Missing Authorization. It means the plugin fails to verify if a user has permission to perform certain actions. Consequently, an unauthenticated attacker can interact with specific AJAX functions to overwrite critical site settings, such as the site URL, which can effectively break your website or disable features.

Do I need to be logged in for an attacker to trigger this bug?

No. The flaw exists within an unauthenticated AJAX action, meaning the attacker does not need an account or valid credentials on your site to initiate the request. The vulnerability is triggered solely by reaching this specific plugin action; it is not dependent on other user-level interactions or existing sessions.

Is my site at risk if it uses WooCommerce Wishlist?

According to Halo Surface Signal, this plugin operates within a public-facing web application, meaning its AJAX actions are reachable from the internet by default. If your site uses this plugin and is accessible to the public, it is considered an externally exposed component that could be targeted.

How should I respond to this vulnerability?

Begin by auditing your environment to confirm where the WooCommerce Wishlist plugin is installed. Assess whether these instances are internet-facing and determine the business impact of a potential site disruption. Prioritize these assets for remediation, such as updating to a patched version once available or temporarily disabling the plugin if the risk to your site availability is too high.

References

wpscan.com/vulnerability/557b9f2b-4673-4efb-b7a5-f68c0b2222ac/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.