Executive brief
The YITH WooCommerce Waitlist Premium plugin is used to manage customer notification lists when products are unavailable. A vulnerability allows authenticated users with basic Subscriber access to escalate their privileges to administrator by exploiting missing security checks in the plugin's AJAX handler. This enables complete takeover of the WordPress site, including access to customer data, payment information, and the ability to modify site content and settings.
Technical details
The vulnerability exists in the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action, which lacks both capability checks and nonce verification. The function uses parse_str() and extract() to import attacker-controlled POST parameters, which are then passed unsanitized to wp_create_user() and user role assignment functions. An authenticated Subscriber-level attacker can send a crafted AJAX request to create a new administrator account, bypassing WordPress privilege controls. The vulnerability affects versions up to 3.35.0; patches should be available from the vendor.
Affected products
- YITH WooCommerce Waitlist Premium up to and including 3.35.0
Timeline
- 2026-09-09: disclosed