PT-2025-46564 · Unknown+1 · Woocommerce+1

Itthidej Aramsri · Published 2025-11-12 · Updated 2025-11-12 · CVE-2025-12087

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Wishlist and Save for later for Woocommerce plugin for WordPress versions through 1.1.22

Description The software contains an Insecure Direct Object Reference issue. An authenticated attacker with Subscriber-level access or higher can delete wishlist items belonging to other users. This is due to a lack of validation on a user-controlled key within the awwlm remove added wishlist page AJAX action.

Recommendations Update The Wishlist and Save for later for Woocommerce plugin for WordPress to a version later than 1.1.22.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-12087

Affected Products

Wishlist/Save For Later For Woocommerce

Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12087 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/17e8a743-7985-4b28-b854-ac052a834f3a?source=cve · Note
• https://t.me/cveNotify/142493 · Telegram Post
• https://plugins.trac.wordpress.org/log/aco-wishlist-for-woocommerce · Note
• https://t.me/CVEtracker/37099 · Telegram Post
• https://twitter.com/CVEnew/status/1988500247619006778 · Twitter Post