Sensitive Data Exposure in YITH WooCommerce Product Add-Ons Plugin by YITH
CVE-2026-66480

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Yith WooCommerce Product Add-ons
Vendor
CVE Published:
10 October 2026

What is CVE-2026-66480?

The YITH WooCommerce Product Add-Ons plugin contains a vulnerability that allows unauthorized access to sensitive system information. This security flaw exposes embedded sensitive data, potentially compromising the integrity and confidentiality of user information. It is crucial for users of versions up to 4.34.0 to implement security measures to protect their e-commerce platforms.

Affected Version(s)

YITH WooCommerce Product Add-Ons <= 4.34.0

References

https://patchstack.com/database/wordpress/plugin/yith-woo...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phat RiO | Patchstack Bug Bounty Program
.