Unauthenticated wishlist deletion via missing authorization checks

Authorization bypass in YITH WooCommerce Wishlist 4.10.0 and earlier allows remote attackers to delete wishlist items over HTTP. The public lists REST route accepts requests through an unconditional permission callback and exposes wishlist tokens, while delete_item validates only a nonce rather than ownership of the targeted wishlist. No account is required, but deletion depends on obtaining the nonce exposed on a shared wishlist page and chaining it with a disclosed token.