Volerion logoVolerion
Volerion logoVolerion

Wishlist for WooCommerce Insecure Direct Object Reference Vulnerability Allowing Unauthenticated Wishlist Manipulation

Vulnerability

A vulnerability exists in the Wishlist for WooCommerce plugin for WordPress, specifically in versions through 1.0.9. This vulnerability is an Insecure Direct Object Reference (IDOR) that allows unauthenticated users to modify other users' wishlists. The issue arises from missing validation on a user-controlled key in several functions within class-th-wishlist-frontend.php.

Impact

Exploitation of this vulnerability allows for unauthorized modification of users' wishlists.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.

Added: Nov 25, 2025, 8:51 AM
Updated: Nov 25, 2025, 8:51 AM

Vulnerability Rating

Custom Algorithm
spread
0.0
impact
0.6
exploitability
6.2
remediation
0.0
relevance
1.2
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.