CVE-2026-92426

UNKNOWN 0.0

YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users.

Vendor	unknown
Product	yith woocommerce popup
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for unknown yith woocommerce popup

Be the first to know when new unknown vulnerabilities affecting unknown yith woocommerce popup are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / YITH WooCommerce Popup

0 < 1.60.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/202f347c-962d-47a9-9dbd-70a20893db69/

Credits

JunHee CHO WPScan