Privilege Escalation in YITH WooCommerce Waitlist Plugin for WordPress

CVE-2026-14359

What is CVE-2026-14359?

The YITH WooCommerce Waitlist Premium plugin for WordPress is susceptible to a privilege escalation vulnerability when utilizing versions up to and including 3.35.0. Specifically, the vulnerability arises from the add_user_in_waiting_list() function, which lacks crucial capability checks and nonce verification. This oversight permits authenticated users with Subscriber privileges or higher to exploit the system by injecting attacker-controlled variables through the $_POST['params'] array. These variables can subsequently be used in wp_create_user() and $user->set_role(), enabling attackers to create new user accounts with administrative privileges. Prompt action is recommended to safeguard against this significant vulnerability.

References