Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons by YITH
CVE-2026-107868

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Yith WooCommerce Product Add-ons
Vendor
CVE Published:
30 October 2026

What is CVE-2026-107868?

The YITH WooCommerce Product Add-Ons plugin version 4.34.0 and earlier is susceptible to an unauthenticated bypass vulnerability. This issue allows attackers to exploit the plugin without proper authorization, potentially leading to unauthorized access or manipulation of data. Users and administrators of YITH WooCommerce Product Add-Ons should take immediate action to mitigate this risk by updating to the latest version or applying necessary security patches.

Affected Version(s)

YITH WooCommerce Product Add-Ons <= 4.34.0

References

https://patchstack.com/database/wordpress/plugin/yith-woo...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mySebbe | Patchstack Bug Bounty Program
.