CVE-2026-66480

Received Received - Intake

Exposure of Sensitive System Information in YITH WooCommerce Product Add-Ons

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-66480

EUVD

EUVD-2026-96425

Affected Vendors & Products

Vendor	Product	Version / Range
YITH	YITH	WooCommerce Product Add-Ons n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-497	The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

Executive Summary

This vulnerability involves the exposure of sensitive system information to unauthorized parties. In the YITH WooCommerce Product Add-Ons plugin, versions up to 4.34.0, sensitive data such as passwords, emails, or payment details could be accessed and stolen by attackers without requiring any special privileges.

Impact Analysis

Attackers could retrieve and misuse sensitive information like passwords, emails, or payment details, leading to potential identity theft, financial loss, or unauthorized account access. The impact is considered low severity but still poses significant risks to user privacy and security.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations such as GDPR or HIPAA, as it involves unauthorized access to sensitive personal or financial data. Organizations may face legal penalties, reputational damage, and loss of customer trust if such breaches occur.

Mitigation Strategies

Update YITH WooCommerce Product Add-Ons to version 4.34.1 or later to patch the vulnerability. If updating is not possible, seek assistance from a hosting provider or web developer. Enable auto-updates for vulnerable plugins if available.

Hi! I’m here to help you understand CVE-2026-66480. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70