YITH WooCommerce Product Add-Ons Unauthenticated Bypass Vulnerability (CVE-2026-107868)
Executive & SecOps Summary
SECOPS ASSESSMENTYITH WooCommerce Product Add-Ons plugin versions 4.34.0 and below.
Unauthenticated attackers can bypass authorization checks by manipulating user-controlled keys to modify data.
Immediately update the plugin to version 4.35.0 or later.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Update Plugin: Navigate to the WordPress admin panel and update the plugin to version 4.35.0 or higher.
- Temporary Mitigation: If an immediate update is not possible, implement WAF rules to inspect and block suspicious parameter manipulations targeting the plugin's endpoints.
# Update via WP-CLI
wp plugin update yith-woocommerce-product-add-onsBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). It occurs when the application fails to properly validate the ownership or authorization of a resource identifier provided by the user. An unauthenticated attacker can exploit this to manipulate product add-on configurations or cart data, potentially leading to unauthorized modifications in the e-commerce workflow. The EPSS score of 0.42 indicates a significant probability of exploitation in the wild.
Official Vendor Advisories & References
Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.