CVE-2026-121779 · Package
NO FIX YET · SEE WHAT TO DO
A flaw in the YITH WooCommerce Subscription WordPress plugin lets an attacker retrieve sensitive data embedded in the plugin's output. The sources do not say which data is exposed or what an attacker can do with it.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Stores running the YITH WooCommerce Subscription plugin at version 4.22.0 or earlier on WordPress with WooCommerce. The sources do not say whether the exposure requires a logged-in account or a specific feature. Sites that do not run this plugin can skip it.
Not affected if plugin-not-installed
Who cares woocommerce, wordpress, yith-woocommerce-subscription
4.22.0.4.22.0.Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Subscription yith-woocommerce-subscription allows Retrieve Embedded Sensitive Data.This issue affects YITH WooCommerce Subscription: from n/a through 4.22.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.