CVE-2026-14359 in WooCommerce Waitlist Premium Plugin
Summary
by MITRE • 09/09/2026
The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST['params'] that are then passed to wp_create_user() and $user->set_role(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator by creating a new user account and assigning it the administrator role.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The YITH WooCommerce Waitlist Premium plugin for WordPress contains a critical privilege escalation vulnerability in versions up to 3.35.0, stemming from insufficient access control mechanisms within its AJAX endpoint handling logic. The core of this flaw resides in the add_user_in_waiting_list() function, which is registered to handle requests via the wp_ajax_yith_wcwtl_add action hook. This specific entry point fails to implement two fundamental security controls: a capability check and nonce verification. In standard WordPress development practices, any AJAX endpoint that performs state-changing operations or accesses sensitive data must verify that the requesting user possesses the necessary capabilities for the intended operation and include a valid nonces to prevent Cross-Site Request Forgery attacks. The absence of these checks allows authenticated users with minimal privileges, such as those holding Subscriber-level access or higher, to interact directly with this function without proper authorization validation.
The technical severity of this vulnerability is significantly amplified by how user input is processed within the vulnerable function. Instead of using safe methods like wp_unslash() and direct variable assignment, the code utilizes parse_str() combined with extract(). This pattern imports variables from the attacker-controlled $_POST['params'] array directly into the local symbol table. Because there are no restrictions on which keys can be extracted or what values they may contain, an authenticated attacker can inject arbitrary parameters that override internal logic flow. Specifically, by manipulating these input fields, the attacker can control the arguments passed to wp_create_user() and $user->set_role(). This lack of input validation allows the injection of administrative credentials during user creation, effectively bypassing WordPress's role-based access control system entirely.
The operational impact of this vulnerability is severe, as it enables a low-privileged authenticated attacker to escalate their privileges to that of an administrator. By exploiting the missing capability checks and insecure variable extraction, an attacker can create a new user account with administrative rights or modify existing accounts to gain elevated permissions. Once an attacker achieves admin-level access, they obtain full control over the WordPress installation. This includes the ability to install malicious plugins, modify core files, execute arbitrary code on the server through theme editors or plugin developers tools, and exfiltrate sensitive database contents such as user credentials and customer data. The lack of nonce verification further facilitates automated exploitation via Cross-Site Request Forgery techniques, allowing attackers to trigger this privilege escalation without requiring complex social engineering tactics beyond basic authentication.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Assignment and CWE-807 Reliance on Untrusted Inputs in Security-Critical Code. The failure to verify user capabilities before performing administrative actions is a classic example of broken access control, while the use of extract() on unsanitized input represents a dangerous reliance on untrusted data that leads to arbitrary code execution or configuration manipulation. In terms of the MITRE ATT&CK framework for enterprise security, this behavior maps directly to T1078 Valid Accounts and specifically T1078.004 Cloud Accounts if applicable, but more accurately reflects T1548 Abuse Elevation Control Mechanism as it involves exploiting a flaw in the operating system or application's privilege management logic to gain higher-level permissions. The exploitation path also touches upon T1190 Exploit Public-Facing Application since the vulnerability is accessible through web-facing AJAX endpoints, and potentially T1053 Scheduled Task/Job if the attacker uses their new admin privileges to persist via cron jobs.
Mitigation strategies for this vulnerability require immediate action by site administrators who are running affected versions of the YITH WooCommerce Waitlist Premium plugin. The primary remediation step is to update the plugin to version 3.36.0 or later, where these security flaws have been addressed through proper capability checks and secure input handling practices that avoid the use of extract() on user-supplied data. For organizations unable to patch immediately due to compatibility constraints, temporary mitigations should include restricting access to WordPress admin endpoints via IP whitelisting if feasible, although this is less effective against authenticated attacks from legitimate users with compromised accounts. Additionally, implementing a Web Application Firewall (WAF) rule that blocks requests containing suspicious patterns in the params parameter for wp_ajax_yith_wcwtl_add actions can provide an additional layer of defense by preventing the specific input manipulation required to trigger the privilege escalation. Regular auditing of plugin code and adherence to WordPress coding standards regarding nonce verification and capability checks are essential preventive measures against similar vulnerabilities in future updates or other plugins.