{"id":"CVE-2026-124763","kind":"vulnerability","aliases":["CVE-2026-124763"],"related":[],"title":"AM Wishlist WordPress plugin (<= 1.1.0) lets anyone overwrite site options","description":"The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).","summary":"WPScan identifies the plugin as AM Wishlist (WordPress.org slug am-wishlist, listed as 'Wishlist for Woocommerce'), versions up to and including 1.1.0. The amwl_upload_file AJAX action has no authorisation or CSRF check, so an anonymous visitor can overwrite any site option (site URL, active theme, active plugins) with an uploaded image URL or an empty value, which can break the site. WPScan rates it CVSS 9.1 and lists no known fix. The PoC is withheld until 2027-02-09.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"am-wishlist","fixed":[],"affected":"<= 1.1.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["am-wishlist","closed-plugin","other","unauthenticated","woocommerce","woocommerce-wishlist","wordpress"],"not_affected_if":["plugin-deactivated-and-removed","plugin-not-installed"],"how_to_check":"- Look for the folder wp-content/plugins/am-wishlist/ (plugin name 'Wishlist for Woocommerce' / 'AM Wishlist') and read the Version header in its main PHP file or in Plugins in wp-admin; 1.1.0 or earlier is affected\n- grep the plugin code for the AJAX action amwl_upload_file\n- Also check any other plugin named 'Woocommerce Wishlist' that you cannot tie to am-wishlist; this is not the same as TI WooCommerce Wishlist, YITH or the other wishlist plugins, which this CVE does not name.","fix":"No fixed version known. WPScan says 'No known fix'. The plugin was closed on WordPress.org on 2025-07-09 (Licensing/Trademark Violation) and is not available for download. Deactivate and delete the plugin, and move to a maintained wishlist plugin.","status":"open","published_at":"2026-11-13T06:16:53+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","triaged_at":"2026-11-13T06:42:26+00:00","updated_at":"2026-11-13T06:45:28+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T06:42:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WooCommerce Wishlist WordPress plugin lets anyone overwrite site options","impact":"medium","summary":"The WooCommerce Wishlist WordPress plugin through 1.1.0 has an unauthenticated AJAX action with no authorisation or CSRF checks. An anonymous visitor can overwrite any WordPress site option, which can break the site or deactivate plugins.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","woocommerce","woocommerce-wishlist"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"anonymous visitors overwrite site options and break the site","analyst_note":"Check the NVD entry and the plugin's WordPress.org page for a fixed version and the vendor's patch status.","how_to_check":"- Look for the plugin folder `woocommerce-wishlist` under `wp-content/plugins/` and check its version in the plugin list of the WordPress admin\n- Confirm whether the installed version is `1.1.0` or earlier","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WooCommerce Wishlist WordPress plugin at version 1.1.0 or earlier are exposed, since its unauthenticated AJAX action accepts requests without checks. Sites that do not have this plugin installed are not affected. The sources do not say whether a fixed version exists.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000748,"input_tokens":4596,"output_tokens":576,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the NVD entry and the plugin's WordPress.org page for a fixed version and the vendor's patch status.","search":"'-02':113B '-09':114B '-124763':13A,16A '-2026':12A,15A '1.1.0':5A,55B,121C,174C '2027':112B '9.1':101B 'action':61B,135C 'activ':79B,81B,165C 'ajax':60B,134C 'allow':136C 'am':18A 'am-wishlist':17A,20B,42B 'amwl':57B 'anonym':70B 'anyon':7A 'authoris':64B,125C 'break':94B,155C 'chang':161C 'check':67B,128C 'close':24B 'closed-plugin':23B 'csrf':66B,127C 'cve':11A,14A 'cvss':100B 'deactiv':167C 'empti':90B,153C 'everi':168C 'exampl':159C 'file':59B 'fix':106B 'identifi':34B 'imag':86B,150C 'includ':54B 'known':105B 'let':6A 'list':45B,103B 'one':130C 'option':10A,76B,143C 'overwrit':8A,73B,140C 'plugin':4A,25B,36B,82B,119C,172C 'poc':108B 'rate':98B 'site':9A,75B,77B,96B,142C,157C 'slug':41B 'theme':80B 'unauthent':27B,133C,137C 'upload':58B,85B,149C 'url':78B,87B,146C,163C 'user':138C 'valu':91B,154C 'version':50B 'visitor':71B 'wishlist':2A,19A,22B,31B,39B,44B,47B,117C,170C 'withheld':110B 'woocommerc':28B,30B,49B,116C,169C 'woocommerce-wishlist':29B 'wordpress':3A,32B,118C,171C 'wordpress.org':40B 'wpscan':33B,97B","nicknames":[],"mitigations":[],"who_affected":"Sites running the AM Wishlist plugin (am-wishlist, 'Wishlist for Woocommerce' by rushikshah) at 1.1.0 or earlier. Any visitor can send the AJAX request without logging in, so the exposure is every site with it active. Sites without this plugin can skip it. The NVD text says 'Woocommerce Wishlist', but WPScan names the plugin AM Wishlist; other wishlist plugins are not named.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["amwishlist"],"ptokens":["am","wishlist"],"labels":["amwishlist","closedplugin","critical","other","unauthenticated","woocommerce","woocommercewishlist","wordpress"],"campaign_type":null,"search_a":"'-124763':13A,16A '-2026':12A,15A '1.1.0':5A 'am':18A 'am-wishlist':17A 'anyon':7A 'cve':11A,14A 'let':6A 'option':10A 'overwrit':8A 'plugin':4A 'site':9A 'wishlist':2A,19A 'wordpress':3A","search_b":"'-02':113B '-09':114B '1.1.0':55B '2027':112B '9.1':101B 'action':61B 'activ':79B,81B 'ajax':60B 'am-wishlist':20B,42B 'amwl':57B 'anonym':70B 'authoris':64B 'break':94B 'check':67B 'close':24B 'closed-plugin':23B 'csrf':66B 'cvss':100B 'empti':90B 'file':59B 'fix':106B 'identifi':34B 'imag':86B 'includ':54B 'known':105B 'list':45B,103B 'option':76B 'overwrit':73B 'plugin':25B,36B,82B 'poc':108B 'rate':98B 'site':75B,77B,96B 'slug':41B 'theme':80B 'unauthent':27B 'upload':58B,85B 'url':78B,87B 'valu':91B 'version':50B 'visitor':71B 'wishlist':22B,31B,39B,44B,47B 'withheld':110B 'woocommerc':28B,30B,49B 'woocommerce-wishlist':29B 'wordpress':32B 'wordpress.org':40B 'wpscan':33B,97B","search_c":"'1.1.0':121C,174C 'action':135C 'activ':165C 'ajax':134C 'allow':136C 'authoris':125C 'break':155C 'chang':161C 'check':128C 'csrf':127C 'deactiv':167C 'empti':153C 'everi':168C 'exampl':159C 'imag':150C 'one':130C 'option':143C 'overwrit':140C 'plugin':119C,172C 'site':142C,157C 'unauthent':133C,137C 'upload':149C 'url':146C,163C 'user':138C 'valu':154C 'wishlist':117C,170C 'woocommerc':116C,169C 'wordpress':118C,171C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124763","severity":null,"published_at":"2026-11-13T06:16:53+00:00","modified_at":"2026-11-13T06:16:53+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","fetched_at":"2026-11-13T06:42:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124763:3827","url":"https://wpscan.com/vulnerability/557b9f2b-4673-4efb-b7a5-f68c0b2222ac/","severity":null,"published_at":"2026-11-13T06:45:28+00:00","modified_at":"2026-11-13T06:45:28+00:00","first_seen_at":"2026-11-13T06:45:28+00:00","fetched_at":"2026-11-13T06:45:28+00:00","note":"NVD says 'Woocommerce Wishlist <=1.1.0'. WPScan (CVE source, third-party DB) names it AM Wishlist, CVSS 9.1, no known fix, PoC withheld to 2027-02-09. WordPress.org am-wishlist is at 1.1.0 and was closed 2025-07-09. The slug match is inferred from the name and version. No vendor advisory exists, so nothing is marked verified. Not exploited per sources; no public PoC.","cites":["https://wpscan.com/vulnerability/557b9f2b-4673-4efb-b7a5-f68c0b2222ac/","https://wordpress.org/plugins/am-wishlist/"]}],"documents":[{"id":143478,"url":"https://wpscan.com/vulnerability/557b9f2b-4673-4efb-b7a5-f68c0b2222ac/","title":"AM Wishlist <= 1.1.0 - Unauthenticated Option Overwrite via amwl_upload_file (WPScan)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":143479,"url":"https://wordpress.org/plugins/am-wishlist/","title":"Wishlist for Woocommerce (am-wishlist) - WordPress.org, closed","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}