AM-WISHLIST · CVE-2026-124763 · Other
NO FIX YET · SEE WHAT TO DO
WPScan identifies the plugin as AM Wishlist (WordPress.org slug am-wishlist, listed as 'Wishlist for Woocommerce'), versions up to and including 1.1.0. The amwl_upload_file AJAX action has no authorisation or CSRF check, so an anonymous visitor can overwrite any site option (site URL, active theme, active plugins) with an uploaded image URL or an empty value, which can break the site. WPScan rates it CVSS 9.1 and lists no known fix. The PoC is withheld until 2027-02-09.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the AM Wishlist plugin (am-wishlist, 'Wishlist for Woocommerce' by rushikshah) at 1.1.0 or earlier. Any visitor can send the AJAX request without logging in, so the exposure is every site with it active. Sites without this plugin can skip it. The NVD text says 'Woocommerce Wishlist', but WPScan names the plugin AM Wishlist; other wishlist plugins are not named.
Not affected if plugin-deactivated-and-removed, plugin-not-installed
Who cares am-wishlist, closed-plugin, unauthenticated, woocommerce, woocommerce-wishlist, wordpress
No known fixPosts are quoted with a link to the original. They are data to us, never instructions.
The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.