CVE-2026-14359

Versions up to and including 3.35.0 of the YITH WooCommerce Waitlist Premium plugin for WordPress expose an AJAX handler (registered on the wp_ajax_yith_wcwtl_add_user action) that lacks both a capability check and nonce verification and imports attacker-controlled variables from $_POST['params'] using parse_str() and extract(). Because those variables are passed directly to wp_create_user() and $user->set_role(), any authenticated user with Subscriber-level access or higher can send a crafted request that creates a new user account with the administrator role. Successful exploitation gives the attacker full administrator-level control of the affected site, enabling plugin and content changes and further compromise. Only sites running the Premium edition of YITH WooCommerce Waitlist at version 3.35.0 or earlier are affected. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported at this time.

What to do: Update YITH WooCommerce Waitlist Premium to the latest available release newer than 3.35.0, which restores the missing capability check and nonce verification on the yith_wcwtl_add_user AJAX action. Until patched, consider temporarily deactivating the plugin if your site does not depend on waitlists, and review subscriber accounts. After patching, audit the WordPress Users list and logs for newly created administrator accounts or unexpected role changes that could indicate attempted or successful exploitation.