CVE-2026-107868

Name of the Vulnerable Software and Affected Versions YITH WooCommerce Product Add-Ons versions prior to 4.34.1

Description An authorization bypass exists due to missing visibility and publication status checks on the product id parameter in AJAX handlers before returning product add-on data. This allows unauthenticated attackers to retrieve add-on configuration and pricing data for products that are not publicly visible, bypassing product visibility restrictions.

Recommendations Update YITH WooCommerce Product Add-Ons to a version newer than 4.34.0.