A critical security vulnerability affecting the AM Wishlist plugin for WooCommerce can allow unauthenticated attackers to overwrite important WordPress configuration settings. The flaw, tracked as CVE-2026-124763, was publicly disclosed on November 13, 2026, and affects plugin versions up to and including 1.1.0.
According to the security advisory, an attacker does not need a WordPress account or administrator privileges to exploit the vulnerable functionality. By abusing an insufficiently protected AJAX action, an attacker may modify sensitive WordPress options, potentially changing the website address, disabling plugins or disrupting the active theme configuration.
The vulnerability has received a critical CVSS 3.1 severity score of 9.1. No official patched version was available at the time of disclosure. Furthermore, the affected plugin had already been closed in the WordPress.org plugin directory in July 2025, making immediate verification and mitigation particularly important for WooCommerce store owners.
What Is CVE-2026-124763?
CVE-2026-124763 is an unauthenticated WordPress option overwrite vulnerability in the AM Wishlist plugin, also identified as Woocommerce Wishlist in security databases.
The vulnerability was reported by security researcher Usama Arshad and coordinated through WPScan.
The issue is documented in GitHub Security Advisory GHSA-9c3x-hc2h-94xp.
The vulnerability affects a specific wishlist extension. It is not a vulnerability in WooCommerce core and does not automatically affect every WooCommerce wishlist plugin.
The affected plugin can be identified by the following information:
| Component | Details |
|---|---|
| Plugin | AM Wishlist / Woocommerce Wishlist |
| WordPress.org slug | am-wishlist |
| Affected versions | 1.1.0 and earlier |
| CVE identifier | CVE-2026-124763 |
| GitHub advisory | GHSA-9c3x-hc2h-94xp |
| CVSS 3.1 score | 9.1 – Critical |
| Attack privileges | None required |
| Vulnerable functionality | amwl_upload_file |
| Official patch status | No confirmed fix as of November 14, 2026 |
The vulnerability affects the integrity and availability of WordPress websites. Its published CVSS vector does not indicate a direct confidentiality impact.
However, the ability to modify important WordPress options is serious enough to cause operational disruption even without reading protected data or executing arbitrary PHP code.
How Does the AM Wishlist Vulnerability Work?
The root cause is insufficient access control in an AJAX action used by the plugin.
WordPress plugins frequently use AJAX endpoints to process requests without requiring a complete page reload.
These endpoints may support operations such as adding products to wishlists, updating user preferences, submitting forms or uploading files.
When an AJAX action modifies important website settings, it must enforce appropriate authorization and request validation.
In the affected AM Wishlist versions, the relevant functionality does not implement the required protections.
The Vulnerable AJAX Action
The security advisory identifies the following AJAX action:
amwl_upload_fileThe action is accessible without authentication.
According to the published vulnerability description, it does not perform sufficient authorization or Cross-Site Request Forgery checks before processing the affected operation.
As a result, an unauthenticated requester can cause the plugin to overwrite an arbitrary WordPress option with either an uploaded image URL or an empty value.
This is the central security failure.
The plugin exposes functionality that can modify sensitive application configuration without ensuring that the requester has permission to make those changes.
Why Missing Authorization Is Dangerous
WordPress uses a role and capability system to control access to administrative functions.
Ordinary visitors should not be allowed to change core configuration settings such as the website URL, active plugins or active theme.
These operations are normally restricted to appropriately authorized administrators.
In the vulnerable plugin, the affected action bypasses the expected authorization boundary.
The attack does not require the adversary to obtain an administrator password or compromise a legitimate WordPress account first.
The Missing CSRF Protection
The advisory also identifies missing CSRF protection.
CSRF protections help ensure that sensitive state-changing requests originate from an expected workflow.
In WordPress, nonce verification is commonly used as one part of this protection.
However, a nonce is not a replacement for authorization checks.
For operations involving privileged configuration changes, both appropriate permissions and suitable request validation are necessary.
In this case, the absence of authorization is particularly significant because the affected functionality can be reached without authentication.
Which WordPress Settings Can an Attacker Overwrite?
WordPress stores important website settings in the options system, commonly backed by the wp_options database table.
These options influence how the website loads, which extensions are active and which URLs WordPress uses.
The vulnerability allows an attacker to overwrite arbitrary options with a restricted set of values: an uploaded image URL or an empty value.
Although this does not provide unrestricted control over the contents of every option, the available values can still disrupt essential WordPress functionality.
1. Website URL Settings
Two important WordPress options are:
siteurl
homeThe siteurl option identifies the WordPress installation address, while home controls the public site address.
If these values are replaced with invalid data, WordPress may generate incorrect links or redirects.
Potential consequences include:
- Visitors being redirected to incorrect addresses.
- Broken storefront navigation.
- Incorrect asset and page URLs.
- Problems accessing the WordPress administration.
- Disruption of checkout and customer account pages.
The actual result depends on the site’s configuration and whether URL values are overridden elsewhere, such as in wp-config.php.
2. Active Plugin Configuration
WordPress tracks activated plugins using the option:
active_pluginsIf this value is overwritten with invalid or empty data, WordPress may no longer recognize the previously activated plugins correctly.
For a WooCommerce store, this can be particularly serious.
Disabling or disrupting WooCommerce and its related extensions can affect:
- Product catalogue functionality.
- Shopping cart operations.
- Checkout pages.
- Payment gateways.
- Shipping integrations.
- Order processing.
- Inventory synchronization.
The published advisory explicitly identifies plugin deactivation as a possible consequence of the vulnerability.
This is one of the reasons the flaw can affect the availability of an online store even though the vulnerable component is only a wishlist extension.
3. Active Theme Settings
WordPress uses options such as:
template
stylesheetThese settings identify the active theme and, where applicable, its parent and child theme configuration.
Overwriting them with invalid values may prevent WordPress from correctly locating the active theme.
Depending on the installation, this can cause rendering failures or leave the website with a broken appearance.
The vulnerability should not be interpreted as automatically allowing an attacker to install or activate an arbitrary malicious theme. Its documented capability is to overwrite option values, potentially invalidating the existing theme configuration.
Can CVE-2026-124763 Take a WooCommerce Store Offline?
Yes. The vulnerability can potentially make an affected online store unavailable by modifying configuration values required for normal WordPress operation.
For example, a store may rely on several active extensions to handle payment processing, shipping and checkout validation.
If the active_plugins option is corrupted, WordPress may fail to activate those extensions.
Similarly, incorrect website URLs can interfere with normal routing and redirects.
The consequences may extend beyond the wishlist feature.
A single vulnerable extension can affect application-wide configuration because WordPress options are shared across the installation.
Possible HTTP 500 Errors
Corrupted configuration can cause PHP exceptions or other failures in certain WordPress environments.
Such failures may appear as HTTP 500 Internal Server Error responses.
However, HTTP 500 is not a guaranteed symptom of CVE-2026-124763.
Some affected installations may instead experience redirects, missing functionality, disabled plugins or inaccessible pages.
The published advisory describes the ability to disrupt the site, not one universal error message.
Checkout and Payment Disruption
If WooCommerce or a required payment extension is disabled or fails to initialize, customers may be unable to complete purchases.
Depending on the affected configuration, checkout pages may become inaccessible or no longer provide the expected payment methods.
This creates a direct risk to online sales.
The vulnerability does not, by itself, establish that attackers can steal payment card details or modify completed payment transactions.
Customer Account and Storefront Problems
Incorrect WordPress URLs and disabled extensions can also affect customer login, account management and product browsing.
These symptoms may initially resemble a broken WordPress update or plugin conflict.
Without reviewing the underlying configuration changes, administrators may not immediately recognize that a security incident is possible.
How Severe Is CVE-2026-124763?
The vulnerability has been assigned a CVSS 3.1 score of 9.1, corresponding to Critical severity.
The published vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HThe most important characteristics are:
| Security characteristic | Assessment |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Integrity impact | High |
| Availability impact | High |
| Confidentiality impact | None in the published vector |
The absence of a login requirement is a major factor in the risk assessment.
Because the affected AJAX functionality is reachable without authentication, an attacker does not first need to compromise a customer or administrator account.
The ability to alter critical configuration settings also explains the high integrity and availability impact.
However, the severity score describes the potential technical impact. It does not prove that the vulnerability has been exploited against a large number of stores.
Has CVE-2026-124763 Been Exploited in Real Attacks?
As of November 14, 2026, no verified public evidence reviewed for this vulnerability establishes widespread exploitation against WooCommerce stores.
The vulnerability is publicly documented, and its technical characteristics make it potentially serious.
Nevertheless, a public security advisory should not be confused with confirmation of an active attack campaign.
There is also no verified public estimate of the number of currently exposed stores using the affected plugin.
Administrators should act according to the documented risk rather than wait for confirmed exploitation.
AM Wishlist Was Already Closed in the WordPress Plugin Directory
An important detail is the plugin’s distribution status.
The official WordPress.org directory page for AM Wishlist confirms that the extension was closed on July 9, 2025.
The listed reason was a licensing or trademark violation.
The plugin is no longer available for download through the official directory.
Its directory page identifies version 1.1.0 as the listed release.
This closure predates the public disclosure of CVE-2026-124763.
The closure reason does not establish that the plugin was removed because of this security vulnerability.
However, the absence of an actively distributed patched release creates an important maintenance concern for stores that still have the extension installed.
WordPress installations can continue running previously installed plugins even after those plugins have been removed from the public directory.
Consequently, the fact that AM Wishlist is no longer available for new downloads does not mean that all existing installations are protected.
How to Check Whether Your WooCommerce Store Uses AM Wishlist
The first step is to identify the exact plugin installed on the website.
This distinction matters because several unrelated WordPress plugins provide wishlist functionality.
A store using YITH WooCommerce Wishlist, TI WooCommerce Wishlist or another wishlist extension should not automatically be considered affected by CVE-2026-124763.
The advisory concerns the specific AM Wishlist plugin.
1. Check the WordPress Plugin List
Log in to WordPress and open:
Plugins → Installed PluginsLook for the affected plugin, which may appear under its wishlist-related name.
Verify its directory or plugin identifier rather than relying only on a similar display name.
Check the installed version.
Versions up to and including 1.1.0 are listed as vulnerable.
2. Check the Plugin Directory on the Server
With filesystem or SSH access, inspect:
wp-content/plugins/am-wishlist/The presence of this directory is a strong indicator that the affected extension has been installed.
Its current activation status still needs to be checked separately.
The folder may remain present after a plugin has been deactivated.
3. Verify the Installed Version With WP-CLI
Administrators with WP-CLI access can list installed plugins:
wp plugin list --fields=name,status,versionLook for:
am-wishlistTo inspect its installed version directly:
wp plugin get am-wishlist --field=versionIf the command reports version 1.1.0 or earlier, the installation matches the version range identified in the security advisory.
These commands are intended to inspect the installation and do not modify plugin settings.
4. Confirm the Vulnerable Functionality Exists
Administrators reviewing the plugin code can search for the affected AJAX action:
grep -R -n "amwl_upload_file" wp-content/plugins/am-wishlist/This is a read-only source code search.
It helps confirm the presence of the relevant functionality without sending exploit requests to the live website.
The presence of the function alone does not demonstrate that the site has already been attacked.
How to Protect a WooCommerce Store From CVE-2026-124763
The most reliable immediate response is to remove the exposed functionality from production until a verified correction is available.
Because no official patched release was confirmed as of November 14, 2026, store owners should not assume that simply checking for updates will resolve the issue.
1. Deactivate the Vulnerable Plugin
If AM Wishlist 1.1.0 or an earlier version is active, consider deactivating it immediately.
This removes the vulnerable plugin’s normal functionality from the active WordPress environment.
Using WP-CLI:
wp plugin deactivate am-wishlistThis command changes the activation status of the plugin.
Before making changes, ensure that the site has a current backup and that administrator access is available.
After deactivation, verify that the storefront, product pages, cart and checkout still function correctly.
The wishlist feature may stop working until a replacement is installed.
2. Remove the Plugin After Backing Up Relevant Data
Because the extension has been closed in the WordPress plugin directory, removing it may be preferable to leaving an unsupported copy on the server.
Before deletion, determine whether the plugin stores wishlist data that must be preserved.
Take a backup of the database and relevant files.
Once the extension has been deactivated and the required data preserved, remove the obsolete plugin through the normal WordPress administration or deployment process.
Deleting the plugin does not automatically repair WordPress options that were already modified.
3. Consider a Maintained Wishlist Extension
Wishlist functionality can be restored using a maintained alternative compatible with the installed WooCommerce version.
Before selecting a replacement, evaluate its update history, compatibility, security maintenance and support for existing wishlist data.
Do not assume that wishlists created by one plugin can be transferred directly to another without a migration procedure.
4. Use Application-Level Mitigation Where Appropriate
The Patchstack advisory for CVE-2026-124763 confirms that a mitigation rule has been issued to block attacks until an official patch becomes available.
Such protection may be useful where immediate plugin removal is not possible.
However, a mitigation rule is not the same as fixing the vulnerable plugin code.
The protection must be correctly deployed and applicable to the affected installation.
Where practical, deactivating the vulnerable functionality remains the more direct way to remove exposure.
5. Avoid Broad AJAX Blocking Rules
WordPress uses admin-ajax.php for many legitimate operations.
Blocking every request to this endpoint can break unrelated site functions, including features used by themes and other plugins.
Any network-level protection should target the specific vulnerable functionality without unnecessarily affecting legitimate AJAX requests.
Specialized application protection may be more appropriate than a broad rule that blocks the entire endpoint.
How to Check Whether WordPress Settings Have Already Been Changed
If a store has been running the affected plugin, administrators should verify whether important WordPress options are still consistent with the expected configuration.
Finding a vulnerable plugin does not automatically mean the site has been compromised.
However, unexpected configuration changes deserve investigation.
Check the Site URL and Home URL
With WP-CLI, the current settings can be inspected using:
wp --skip-plugins --skip-themes option get home
wp --skip-plugins --skip-themes option get siteurlCompare the results against the correct production addresses.
Unexpected image URLs, empty values or unrelated domains may indicate configuration damage.
Such changes are not necessarily proof of exploitation. They can also result from migration errors or administrative changes.
Check the Active Plugins Option
Inspect the current plugin configuration:
wp --skip-plugins --skip-themes option get active_plugins --format=jsonCompare the result with the expected list of enabled extensions.
For a WooCommerce store, unexpected deactivation of WooCommerce or required payment and shipping extensions should be investigated promptly.
Check the Theme Configuration
The relevant options can be inspected with:
wp --skip-plugins --skip-themes option get template
wp --skip-plugins --skip-themes option get stylesheetVerify that the values identify the intended installed theme and, where applicable, its child theme.
Unexpected empty strings or invalid values may explain theme loading failures.
Review Database Records Without Modifying Them
Administrators can also inspect selected WordPress options directly in the database.
For example:
SELECT
option_name,
option_value
FROM wp_options
WHERE option_name IN (
'siteurl',
'home',
'active_plugins',
'template',
'stylesheet'
);This query only reads the database.
If the WordPress installation uses a custom table prefix, replace wp_ with the appropriate prefix.
The active_plugins value is stored in a serialized format and should not be manually reconstructed without understanding the expected structure.
How to Recover a WooCommerce Store After Configuration Damage
If important WordPress options have already been overwritten, simply deactivating the vulnerable plugin may not restore the website.
The original configuration values may need to be recovered separately.
Restore the Correct Website URLs
If the home or siteurl values are incorrect, compare them with the store’s known configuration and a reliable backup.
Where necessary, use a supported recovery method to restore the expected values.
Administrators should avoid guessing these settings, particularly when the store is installed in a subdirectory, uses a reverse proxy or has separate WordPress and public website URLs.
Restore Required Plugin Activation
If the active plugin configuration was damaged, identify which extensions were previously enabled.
Restore them in a controlled manner, beginning with the components essential for the store to operate.
Do not automatically reactivate the vulnerable AM Wishlist plugin during recovery.
After restoring WooCommerce and its required extensions, verify that the product catalogue, cart, checkout and payment gateways work correctly.
Restore the Active Theme
If theme-related options were overwritten, confirm which theme and child theme were active before the incident.
Restore the correct configuration and clear relevant caches.
Verify that storefront templates and customer-facing pages load normally.
Review Logs and Preserve Evidence
Investigate web server, security and application logs around the time unexpected configuration changes occurred.
Look for suspicious activity involving WordPress AJAX endpoints, particularly requests associated with the affected plugin.
Standard web server access logs may show requests to admin-ajax.php without recording the submitted AJAX action or POST body.
More detailed WAF or application logs may therefore be necessary to identify the specific request.
Preserve relevant evidence before rotating or deleting logs.
If there are signs of broader compromise, extend the investigation beyond the wishlist plugin.
Could an Attacker Steal Customer Data Through This Vulnerability?
The published CVE describes unauthorized modification of WordPress options.
It does not establish a direct ability to extract customer records, download order information or retrieve payment card details.
The CVSS 3.1 vector assigns no direct confidentiality impact to this particular flaw.
That distinction is important.
Although the vulnerability is critical, its documented capability is primarily unauthorized configuration modification and disruption of website availability.
If an affected store has experienced an incident, administrators should investigate any additional evidence rather than assume that customer data was accessed.
Conversely, the absence of confirmed data theft does not make the vulnerability harmless.
A successful disruption of a live WooCommerce store can prevent customers from placing orders and interfere with essential business operations.
Why a Wishlist Plugin Can Affect the Entire WooCommerce Store
Wishlist extensions are often perceived as optional storefront enhancements.
They help customers save products for later or maintain personal shopping lists.
However, WordPress plugins execute within the broader application environment.
Unless their operations are properly restricted, plugins may interact with WordPress APIs and shared configuration settings.
For example, the WordPress Options API can modify important values used throughout the website.
If a plugin exposes an unsafe path to such functionality, the impact can extend far beyond the plugin’s original purpose.
In the AM Wishlist case, an operation associated with file uploading can affect site-wide configuration.
This demonstrates why security reviews must consider the permissions and data access of every installed extension, not just payment or checkout plugins.
Does the Vulnerability Affect Other WooCommerce Wishlist Plugins?
CVE-2026-124763 is associated with the specific plugin identified as AM Wishlist.
It should not automatically be applied to unrelated wishlist extensions.
Different wishlist plugins have different codebases, security models and maintenance histories.
For example, YITH WooCommerce Wishlist and TI WooCommerce Wishlist are separate products.
The presence of wishlist functionality on a store does not establish that the vulnerable AM Wishlist code is installed.
To determine exposure, administrators must identify the actual plugin directory, version and relevant AJAX action.
Other wishlist extensions may have their own vulnerabilities, but those should be investigated under their own security advisories.
Is There an Official Security Patch for AM Wishlist?
As of November 14, 2026, no official patched version has been confirmed in the reviewed vulnerability advisories.
Patchstack lists versions through 1.1.0 as affected and states that no official patch is available.
The WordPress.org directory also confirms that the plugin has been closed since July 2025.
This means administrators should not wait indefinitely for an automatic update while leaving the vulnerable functionality active.
For stores still using AM Wishlist, immediate deactivation and a planned replacement are reasonable protective actions.
If a verified vendor correction becomes available later, it should be tested against the affected installation before deployment.
How to Reduce the Risk From Unsupported WooCommerce Plugins
CVE-2026-124763 illustrates a broader security risk: optional plugins can remain installed for years after their development or distribution status changes.
Regular plugin maintenance should include more than checking for available updates.
Store administrators should periodically review:
- Whether each installed plugin is still required.
- Whether it remains actively maintained.
- Whether its official WordPress.org listing is open or closed.
- Whether known vulnerabilities affect its installed version.
- Whether the developer provides security fixes.
- Whether unused plugins remain installed on the server.
- Whether the extension has access to privileged WordPress functionality.
- Whether a maintained alternative is available.
Removing obsolete extensions reduces the amount of code exposed to potential attackers.
Security monitoring should also cover the entire WordPress environment, including themes, WooCommerce extensions and custom integrations.
Frequently Asked Questions
What is CVE-2026-124763?
It is a critical unauthenticated WordPress option overwrite vulnerability affecting AM Wishlist versions 1.1.0 and earlier. The flaw allows unauthorized modification of site configuration through the amwl_upload_file AJAX action.
Does this vulnerability affect WooCommerce core?
No. The reported issue affects the AM Wishlist extension. It is not a confirmed vulnerability in WooCommerce core.
Can attackers exploit the vulnerability without logging in?
Yes. The security advisory identifies the vulnerable AJAX action as accessible without authentication and missing the required authorization checks.
Can the vulnerability disable WooCommerce plugins?
Yes. Overwriting the WordPress active_plugins option can disrupt plugin activation, potentially disabling WooCommerce and other essential extensions.
Can the vulnerability cause HTTP 500 errors?
Potentially. Invalid WordPress configuration can lead to application failures, but HTTP 500 is not a guaranteed symptom. Redirect problems, missing functionality and incorrect site URLs are also possible.
Which AM Wishlist versions are affected?
Versions up to and including 1.1.0 are identified as vulnerable.
Is a patch available?
As of November 14, 2026, no official fixed release has been confirmed. Patchstack reports that it has issued a mitigation rule, but this does not replace a corrected plugin version.
Is the AM Wishlist plugin still available on WordPress.org?
No. Its official listing states that the plugin was closed on July 9, 2025, for a licensing or trademark violation.
Does the vulnerability affect YITH WooCommerce Wishlist?
Not under this CVE. YITH WooCommerce Wishlist is a separate extension. Its security status must be assessed independently.
Does the vulnerability allow direct payment card theft?
The published advisory does not establish that capability. The documented issue concerns unauthorized modification of WordPress options and potential disruption of the website.
Has the vulnerability been exploited in the wild?
No verified public evidence reviewed as of November 14, 2026 establishes active widespread exploitation. Administrators should nevertheless address the confirmed vulnerability promptly.
Should the plugin be deleted immediately?
For installations running an affected version, deactivation is an appropriate immediate protective measure. After backing up relevant data and confirming that wishlist functionality can be replaced, removal is advisable, particularly because the plugin is no longer distributed through the official WordPress.org directory.
What WooCommerce Store Owners Should Do Now
Store owners should check whether AM Wishlist is installed and determine its exact version.
If version 1.1.0 or an earlier release is active, the installation matches the affected version range identified in CVE-2026-124763.
Because no official patched version is currently confirmed, administrators should prioritize disabling the vulnerable functionality, reviewing important WordPress settings and determining whether any unexpected configuration changes have occurred.
Particular attention should be paid to the website URLs, active plugin list and active theme configuration. These settings can influence the availability of the entire WooCommerce store.
If the store has already experienced unexpected redirects, missing payment methods, disabled plugins or storefront failures, preserve the relevant logs and compare the current configuration against a known-good backup.
AM Wishlist is an example of how a seemingly minor e-commerce feature can introduce a critical security risk when its privileged operations are not properly protected.
For WooCommerce stores, maintaining a secure production environment requires regular extension inventory checks, prompt vulnerability response, reliable backups and the removal of unsupported functionality before it becomes a threat to storefront availability and sales.
0 comments