The YITH WooCommerce Wishlist WordPress plugin versions before 4.18.1 allows any guest to rename a wishlist because the rename action does not check whether the requester has permission to modify that wishlist. If an attacker chooses a target wishlist name, the original name is lost and can be replaced. The attacker can create confusion for legitimate users, tamper with the organization of wishlist items, and potentially use the renamed wishlist for malicious purposes such as phishing or social engineering. The flaw does not allow privilege escalation or code execution, but it does corrupt user data and undermines user trust. The vulnerability is an example of improper authorization and is linked to CWE‑284.

The vulnerability affects the YITH WooCommerce Wishlist plugin on WordPress installations that are configured with a plugin version older than 4.18.1. No specific version list is supplied, but any installation of the plugin before 4.18.1 is potentially exposed.

The flaw can be exploited by sending a crafted HTTP request to the change_wishlist_title endpoint. Authentication is not required, so any internet user can perform the rename. There is no publicly known exploit code, but the attack path is straightforward: a request with the desired wishlist ID and new name is sufficient to trigger the change. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, implying a moderate risk level. Still, because the attacker can modify any wishlist, the integrity impact is significant and the attack sophistication is low.