Is CVE-2026-121779 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121779 being exploited in the wild.

How severe is CVE-2026-121779?

Medium severity, with a CVSS score of 5.3, published 7 November 2026.

Which products and versions are affected?

YITH WooCommerce Subscription through 4.22.0.

Is there a fix for CVE-2026-121779?

Yes: fixed in 4.23.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121779 attacked?

It is attacked over the network.

Am I affected by CVE-2026-121779?

Check whether you run YITH WooCommerce Subscription at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121779: YITH WooCommerce Subscription sensitive data exposure

CVE-2026-121779 · Severity: medium · CVSS 5.3 · Published 2026-11-07

The YITH WooCommerce Subscription plugin for WordPress allows unauthenticated attackers to retrieve sensitive embedded data through the plugin. This could expose private information such as customer emails, payment details, or other confidential data stored within the plugin to unauthorized parties. Websites using this plugin are at risk of data theft and customer information compromise.

Vendors: YITH.

Quick answers

Is CVE-2026-121779 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121779 being exploited in the wild.
How severe is CVE-2026-121779?: Medium severity, with a CVSS score of 5.3, published 7 November 2026.
Which products and versions are affected?: YITH WooCommerce Subscription through 4.22.0.
Is there a fix for CVE-2026-121779?: Yes: fixed in 4.23.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121779 attacked?: It is attacked over the network.
Am I affected by CVE-2026-121779?: Check whether you run YITH WooCommerce Subscription at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.23.0

Technical details

The vulnerability is a sensitive data exposure issue in YITH WooCommerce Subscription plugin versions up to 4.22.0 that allows retrieval of embedded sensitive data without authentication. The attack vector is network-based and requires no user interaction or privileges. An attacker can extract private information like passwords, emails, or payment details from the plugin.

Affected products

YITH WooCommerce Subscription through 4.22.0

Timeline

2026-10-23: disclosed: Reported to Patchstack
2026-11-07: advisory: Published by Patchstack and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.