CVE-2026-14359: YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

Vulnerability summary

CVE-2026-14359 is a high (CVSS 8.8) Improper Privilege Management vulnerability in wordpress yith-woocommerce-waiting-list-premium. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14% of scored vulnerabilities. Fixed in 3.36.0.

Timeline

1. 09-09-2026
   PublishedVulnerability first disclosed.
2. 09-09-2026
   Last modifiedVulnerability information updated.

Description

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST['params'] that are then passed to wp_create_user() and $user->set_role(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator by creating a new user account and assigning it the administrator role.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.