Vulnerabilities / YITH WooCommerce Product Add-Ons / WPSEC-2026-3061
YITH WooCommerce Product Add-Ons <= 4.35.0 - Unauthenticated Limited File Upload
Medium 5.3
CWE-434Fixed in 4.35.1
- ID
- WPSEC-2026-3061
- Plugin
- YITH WooCommerce Product Add-Ons (yith-woocommerce-product-add-ons)
- Affected
- all versions before 4.35.1
- Remediation
- Update to 4.35.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-434
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- YITH WooCommerce Product Add-Ons on WPSec AttackSurface
- Fix released
- Published
Description
The YITH WooCommerce Product Add-Ons plugin for WordPress is vulnerable to unauthorized file uploads in all versions up to, and including, 4.35.0. This is due to the file upload AJAX action being registered for unauthenticated users with no capability check, while accepting any file type WordPress allows by default. This makes it possible for unauthenticated attackers to upload files of those types, such as images and documents, to the server's uploads directory.
References
- https://wpsec.com/vuln/WPSEC-2026-3061/
- https://plugins.svn.wordpress.org/yith-woocommerce-product-add-ons/tags/4.35.1/
- https://wordpress.org/plugins/yith-woocommerce-product-add-ons/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS