PT-2025-41649 · WordPress · Wpc Smart Wishlist For Woocommerce

Athiwat Tiprasaharn + 1 · Published 2025-10-11 · Updated 2025-10-11 · CVE-2025-11518

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WPC Smart Wishlist for WooCommerce plugin for WordPress versions up to and including 5.0.3

Description The software is susceptible to an Insecure Direct Object Reference issue in several wishlist AJAX functions. This is due to a lack of validation on a user-controlled key that is exposed when wishlists are shared. This allows unauthenticated attackers to manipulate other users' wishlists, including adding items and emptying them, if they have access to the key.

Recommendations Update the WPC Smart Wishlist for WooCommerce plugin to a version later than 5.0.3.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-11518

Affected Products

Wpc Smart Wishlist For Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11518 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/afe275b4-edc0-4b19-a91f-5099a085e8ce?source=cve · Note
• https://t.me/cveNotify/138326 · Telegram Post
• https://twitter.com/CVEnew/status/1976931322967839043 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1976980970319261728 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3375421%40woo-smart-wishlist&new=3375421%40woo-smart-wishlist&sfp_email=&sfph_mail= · Note