CVE-2026-92426

Deferred Deferred - Pending Action

Arbitrary Post Meta Deletion in YITH WooCommerce Popup WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: WPScan

Description

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92426

EUVD

EUVD-2026-100864

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	YITH	WooCommerce Popup 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects the YITH WooCommerce Popup WordPress plugin versions below 1.60.0. It allows users with the Contributor role or higher to delete arbitrary post meta from any post, including content owned by higher-privileged users. This happens because the plugin does not check user capabilities before performing deletions.

Detection Guidance

Check the installed version of the YITH WooCommerce Popup plugin. If it is below 1.60.0, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

An attacker with Contributor access or higher could delete important post meta data from posts, potentially removing content, settings, or other critical information. This could disrupt website functionality, corrupt data, or lead to loss of important content.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to delete post meta, including sensitive content. Unauthorized deletion of data may violate GDPR's integrity principle and HIPAA's access controls, leading to non-compliance risks.

Mitigation Strategies

Update the YITH WooCommerce Popup plugin to version 1.60.0 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update can be applied.

Hi! I’m here to help you understand CVE-2026-92426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70