YITH WooCommerce Waitlist Premium <= 3.35.0 — Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under YITH WooCommerce Waitlist Premium.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 3.36.0, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch YITH WooCommerce Waitlist Premium to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Michele Genito.

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST['params'] that are then passed to wp_create_user() and $user->set_role(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator by creating a new user account and assigning it the administrator role.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Sep 8, 2026

   CVE published

   Severity high, CVSS 8.8

2. Nov 13, 2026

   Record last updated