The YITH WooCommerce Wishlist plugin fails to verify that a user is authorized to perform actions on the REST API endpoint /wp-json/yith/wishlist/v1/lists, which uses permission_callback => '__return_true', and the AJAX delete_item handler only checks nonce validity without validating object-level authorization, allowing an unauthenticated attacker to discover a wishlist token for any user and subsequently delete wishlist items. The primary impact is loss of user data integrity and potential privacy disclosure through exposed tokens.

YITH WooCommerce Wishlist plugin for WordPress versions up to and including 4.10.0 are affected; all earlier releases are also vulnerable to the same authorization bypass and token disclosure flaws.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is less than 1%, suggesting exploitation likelihood is low but not negligible; the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely through unauthenticated access to the shared wishlist REST endpoint and the AJAX delete_item handler, allowing a remote attacker to chain the token disclosure and deletion operations without any authentication.