# YITH WooCommerce Product Add-Ons <= 4.35.0 - Unauthenticated Limited File Upload

- **ID:** WPSEC-2026-3061
- **Plugin:** YITH WooCommerce Product Add-Ons (`yith-woocommerce-product-add-ons`), https://wordpress.org/plugins/yith-woocommerce-product-add-ons/
- **Affected versions:** all versions before 4.35.1
- **Fixed in:** 4.35.1 (Update to 4.35.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-434
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/yith-woocommerce-product-add-ons
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3061/

## Description

The YITH WooCommerce Product Add-Ons plugin for WordPress is vulnerable to unauthorized file uploads in all versions up to, and including, 4.35.0. This is due to the file upload AJAX action being registered for unauthenticated users with no capability check, while accepting any file type WordPress allows by default. This makes it possible for unauthenticated attackers to upload files of those types, such as images and documents, to the server's uploads directory.

## References

- https://wpsec.com/vuln/WPSEC-2026-3061/
- https://plugins.svn.wordpress.org/yith-woocommerce-product-add-ons/tags/4.35.1/
- https://wordpress.org/plugins/yith-woocommerce-product-add-ons/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3061/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.