{"id":"CVE-2026-121779","kind":"vulnerability","aliases":["CVE-2026-121779"],"related":[],"title":"YITH WooCommerce Subscription: embedded sensitive data exposed to unauthorized users","description":"Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Subscription yith-woocommerce-subscription allows Retrieve Embedded Sensitive Data.This issue affects YITH WooCommerce Subscription: from n/a through 4.22.0.","summary":"A flaw in the YITH WooCommerce Subscription WordPress plugin lets an attacker retrieve sensitive data embedded in the plugin's output. The sources do not say which data is exposed or what an attacker can do with it.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","woocommerce","wordpress","yith-woocommerce-subscription"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the YITH WooCommerce Subscription plugin (yith-woocommerce-subscription) in the WordPress plugins screen or the plugin file header.\n- Compare it with the range in the advisory: from n/a through `4.22.0`.","fix":"- YITH WooCommerce Subscription: unknown fixed version in the sources; the affected range ends at `4.22.0`.","status":"open","published_at":"2026-11-07T09:17:14+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","triaged_at":"2026-11-07T09:47:59+00:00","updated_at":"2026-11-07T09:47:59+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-07T09:47:59Z","model":"claude-haiku-5-5","output":{"fix":"- YITH WooCommerce Subscription: unknown fixed version in the sources; the affected range ends at `4.22.0`.","reach":"internet","title":"YITH WooCommerce Subscription: embedded sensitive data exposed to unauthorized users","impact":"medium","summary":"A flaw in the YITH WooCommerce Subscription WordPress plugin lets an attacker retrieve sensitive data embedded in the plugin's output. The sources do not say which data is exposed or what an attacker can do with it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","yith-woocommerce-subscription"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Sensitive embedded data readable by unauthorized visitors","analyst_note":"Find the vendor advisory or the NVD entry detail to confirm which data is exposed, whether login is needed, and the first fixed version.","how_to_check":"- Check the installed version of the YITH WooCommerce Subscription plugin (yith-woocommerce-subscription) in the WordPress plugins screen or the plugin file header.\n- Compare it with the range in the advisory: from n/a through `4.22.0`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Stores running the YITH WooCommerce Subscription plugin at version 4.22.0 or earlier on WordPress with WooCommerce. The sources do not say whether the exposure requires a logged-in account or a specific feature. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00073,"input_tokens":4245,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121779':13A,16A '-2026':12A,15A '4.22.0':91C 'affect':84C 'allow':78C 'attack':35B,57B 'control':66C 'cve':11A,14A 'data':6A,38B,51B 'data.this':82C 'embed':4A,39B,80C 'expos':7A,53B 'exposur':58C 'flaw':25B 'inform':62C 'issu':83C 'let':33B 'n/a':89C 'output':44B 'packag':17B 'plugin':32B,42B 'retriev':36B,79C 'say':49B 'sensit':5A,37B,60C,81C 'sourc':46B 'sphere':67C 'subscript':3A,23B,30B,73C,77C,87C 'system':61C 'unauthor':9A,65C 'user':10A 'vulner':68C 'woocommerc':2A,18B,22B,29B,72C,76C,86C 'wordpress':19B,31B 'yith':1A,21B,28B,70C,71C,75C,85C 'yith-woocommerce-subscript':20B,74C","nicknames":[],"mitigations":[],"who_affected":"Stores running the YITH WooCommerce Subscription plugin at version 4.22.0 or earlier on WordPress with WooCommerce. The sources do not say whether the exposure requires a logged-in account or a specific feature. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","woocommerce","wordpress","yithwoocommercesubscription"],"campaign_type":null,"search_a":"'-121779':13A,16A '-2026':12A,15A 'cve':11A,14A 'data':6A 'embed':4A 'expos':7A 'sensit':5A 'subscript':3A 'unauthor':9A 'user':10A 'woocommerc':2A 'yith':1A","search_b":"'attack':35B,57B 'data':38B,51B 'embed':39B 'expos':53B 'flaw':25B 'let':33B 'output':44B 'packag':17B 'plugin':32B,42B 'retriev':36B 'say':49B 'sensit':37B 'sourc':46B 'subscript':23B,30B 'woocommerc':18B,22B,29B 'wordpress':19B,31B 'yith':21B,28B 'yith-woocommerce-subscript':20B","search_c":"'4.22.0':91C 'affect':84C 'allow':78C 'control':66C 'data.this':82C 'embed':80C 'exposur':58C 'inform':62C 'issu':83C 'n/a':89C 'retriev':79C 'sensit':60C,81C 'sphere':67C 'subscript':73C,77C,87C 'system':61C 'unauthor':65C 'vulner':68C 'woocommerc':72C,76C,86C 'yith':70C,71C,75C,85C 'yith-woocommerce-subscript':74C","first_public_at":"2026-11-07T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121779","severity":null,"published_at":"2026-11-07T09:17:14+00:00","modified_at":"2026-11-07T09:17:14+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","fetched_at":"2026-11-07T09:46:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}