---
id: "CVE-2026-124763"
page: "https://infrastack.ai/live/CVE-2026-124763"
kind: "vulnerability"
aliases: ["CVE-2026-124763"]
title: "AM Wishlist WordPress plugin (<= 1.1.0) lets anyone overwrite site options"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "am-wishlist", "fixed": [], "affected": "<= 1.1.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["am-wishlist", "closed-plugin", "other", "unauthenticated", "woocommerce", "woocommerce-wishlist", "wordpress"]
not_affected_if: ["plugin-deactivated-and-removed", "plugin-not-installed"]
published_at: "2026-11-13T06:16:53+00:00"
first_seen_at: "2026-11-13T06:42:16+00:00"
updated_at: "2026-11-13T06:45:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124763", "first_seen_at": "2026-11-13T06:42:16+00:00"}, {"source": "analyst", "url": "https://wpscan.com/vulnerability/557b9f2b-4673-4efb-b7a5-f68c0b2222ac/", "first_seen_at": "2026-11-13T06:45:28+00:00", "cites": ["https://wpscan.com/vulnerability/557b9f2b-4673-4efb-b7a5-f68c0b2222ac/", "https://wordpress.org/plugins/am-wishlist/"]}]
exploit_sources: []
---

# AM Wishlist WordPress plugin (<= 1.1.0) lets anyone overwrite site options

Link for people: https://infrastack.ai/live/CVE-2026-124763 (this .md is for agents)

WPScan identifies the plugin as AM Wishlist (WordPress.org slug am-wishlist, listed as 'Wishlist for Woocommerce'), versions up to and including 1.1.0. The amwl_upload_file AJAX action has no authorisation or CSRF check, so an anonymous visitor can overwrite any site option (site URL, active theme, active plugins) with an uploaded image URL or an empty value, which can break the site. WPScan rates it CVSS 9.1 and lists no known fix. The PoC is withheld until 2027-02-09.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:am-wishlist affected <= 1.1.0 fixed no fixed version listed

## How to check

- Look for the folder wp-content/plugins/am-wishlist/ (plugin name 'Wishlist for Woocommerce' / 'AM Wishlist') and read the Version header in its main PHP file or in Plugins in wp-admin; 1.1.0 or earlier is affected
- grep the plugin code for the AJAX action amwl_upload_file
- Also check any other plugin named 'Woocommerce Wishlist' that you cannot tie to am-wishlist; this is not the same as TI WooCommerce Wishlist, YITH or the other wishlist plugins, which this CVE does not name.

## Fix

No fixed version known. WPScan says 'No known fix'. The plugin was closed on WordPress.org on 2025-07-09 (Licensing/Trademark Violation) and is not available for download. Deactivate and delete the plugin, and move to a maintained wishlist plugin.

## Timeline

- 2026-11-13T06:42:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124763
- 2026-11-13T06:45:28+00:00 analyst https://wpscan.com/vulnerability/557b9f2b-4673-4efb-b7a5-f68c0b2222ac/ — NVD says 'Woocommerce Wishlist <=1.1.0'. WPScan (CVE source, third-party DB) names it AM Wishlist, CVSS 9.1, no known fix, PoC withheld to 2027-02-09. WordPress.org am-wishlist is at 1.1.0 and was closed 2025-07-09. The slug match is inferred from the name and version. No vendor advisory exists, so nothing is marked verified. Not exploited per sources; no public PoC.

## Documents

- [advisory] AM Wishlist <= 1.1.0 - Unauthenticated Option Overwrite via amwl_upload_file (WPScan) https://wpscan.com/vulnerability/557b9f2b-4673-4efb-b7a5-f68c0b2222ac/
- [describes] Wishlist for Woocommerce (am-wishlist) - WordPress.org, closed https://wordpress.org/plugins/am-wishlist/

## From the sources

The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_