← Database

CVE-2025-12040

MEDIUM CVSS: 6.5 Published: 2025-11-25 Modified: 2026-06-17

Description

The Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.3 via several functions in class-th-wishlist-frontend.php due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to modify other user's wishlists

Affected Platforms

Unknown

Weakness Type

CWE-639

References