---
id: "CVE-2026-121779"
page: "https://infrastack.ai/live/CVE-2026-121779"
kind: "vulnerability"
aliases: ["CVE-2026-121779"]
title: "YITH WooCommerce Subscription: embedded sensitive data exposed to unauthorized users"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "woocommerce", "wordpress", "yith-woocommerce-subscription"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-07T09:17:14+00:00"
first_seen_at: "2026-11-07T09:46:24+00:00"
updated_at: "2026-11-07T09:47:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121779", "first_seen_at": "2026-11-07T09:46:24+00:00"}]
exploit_sources: []
---

# YITH WooCommerce Subscription: embedded sensitive data exposed to unauthorized users

Link for people: https://infrastack.ai/live/CVE-2026-121779 (this .md is for agents)

A flaw in the YITH WooCommerce Subscription WordPress plugin lets an attacker retrieve sensitive data embedded in the plugin's output. The sources do not say which data is exposed or what an attacker can do with it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the YITH WooCommerce Subscription plugin (yith-woocommerce-subscription) in the WordPress plugins screen or the plugin file header.
- Compare it with the range in the advisory: from n/a through `4.22.0`.

## Fix

- YITH WooCommerce Subscription: unknown fixed version in the sources; the affected range ends at `4.22.0`.

## Timeline

- 2026-11-07T09:46:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121779

## From the sources

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Subscription yith-woocommerce-subscription allows Retrieve Embedded Sensitive Data.This issue affects YITH WooCommerce Subscription: from n/a through 4.22.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_