{
 "id": "WPSEC-2026-0494",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0494/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0494/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0494/index.md",
 "title": "YITH WooCommerce Product Add-Ons <= 4.34.0 - Unauthenticated Information Exposure of Unpublished Product Prices",
 "description": "The YITH WooCommerce Product Add-Ons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.34.0. This is due to the 'live_print_blocks', 'update_totals_with_suffix' and 'get_default_variation_price' AJAX actions accepting an arbitrary product ID and returning that product's price without checking that the product is published. This makes it possible for unauthenticated attackers to retrieve the prices of unpublished (draft, pending, scheduled or private) products.",
 "plugin": {
  "slug": "yith-woocommerce-product-add-ons",
  "name": "YITH WooCommerce Product Add-Ons",
  "full_name": "YITH WooCommerce Product Add-Ons",
  "wordpress_org": "https://wordpress.org/plugins/yith-woocommerce-product-add-ons/",
  "advisories_url": "https://wpsec.com/vuln/plugin/yith-woocommerce-product-add-ons/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/yith-woocommerce-product-add-ons"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0.3",
    "from_inclusive": true,
    "to": "4.34.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0.3 before 4.34.1"
  ]
 },
 "introduced_in": "2.0.3",
 "fixed_in": "4.34.1",
 "remediation": "Update to 4.34.1 or later.",
 "fix_released": "2026-10-06T08:14:26+00:00",
 "published": "2026-10-07T08:42:58+00:00",
 "updated": "2026-10-06T18:33:30.088165+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0494/",
  "https://plugins.svn.wordpress.org/yith-woocommerce-product-add-ons/tags/4.34.1/",
  "https://wordpress.org/plugins/yith-woocommerce-product-add-ons/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/yith-woocommerce-product-add-ons",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-07"
 }
}