CVE-2026-92426 YITH CVE debrief

Who should care

Defenders responsible for WordPress installations with the YITH WooCommerce Popup plugin should assess exposure and verify the version of the plugin. This includes administrators, security teams, and IT personnel managing WordPress environments. They should prioritize verifying the plugin version and restricting post meta deletion capabilities to authorized users. Additionally, defenders should monitor for suspicious post meta deletion activity and review

Why it matters

The YITH WooCommerce Popup WordPress plugin vulnerability allows users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users. Defenders should prioritize verifying the version of the plugin and restricting post meta deletion capabilities to authorized users.

• Defenders need to verify the version of YITH WooCommerce Popup to prevent arbitrary post meta deletion.
• Restricting post meta deletion capabilities to authorized users can mitigate the vulnerability.
• Monitoring for suspicious post meta deletion activity can help detect potential exploitation.

Technical summary

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users. This vulnerability is related to improper access control and could lead to unauthorized modifications of post meta. Technical details indicate a lack of proper capability checks in the plugin's post meta deletion functionality. Defenders should prioritize verifying the version of YITH WooCommerce Popup and restricting post meta deletion capabilities to authorized users.

Defensive priority

Defenders should prioritize verifying the version of YITH WooCommerce Popup and restricting post meta deletion capabilities to authorized users.

Recommended defensive actions

• Verify the version of YITH WooCommerce Popup and update to 1.60.0 or later if necessary.
• Restrict post meta deletion capabilities to authorized users.
• Monitor for suspicious post meta deletion activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional verification is needed to confirm affected versions and exploitation. The vulnerability is confirmed in versions before 1.60.0 of the YITH WooCommerce Popup plugin. Defenders should verify the plugin version and review post meta deletion capabilities. The source item and CVE record provide initial details, but further review of affected scope and potential exploitation is necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.