PT-2025-47422 · Unknown+1 · Woocommerce+1

Athiwat Tiprasaharn · Published 2025-11-19 · Updated 2025-11-19 · CVE-2025-12427

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions YITH WooCommerce Wishlist plugin versions prior to 4.10.1

Description The YITH WooCommerce Wishlist plugin for WordPress has an issue related to missing validation on user-controlled keys, leading to an Insecure Direct Object Reference. This allows unauthenticated attackers to discover a user's wishlist token ID via the REST API endpoint and AJAX handler. Exploitation enables attackers to rename a victim's wishlist without authorization, potentially leading to defacement, social engineering attacks, mass tampering, and profiling. The REST API endpoint and AJAX handler are involved in this issue. The vulnerable key is the wishlist token ID.

Recommendations Update the YITH WooCommerce Wishlist plugin to version 4.10.1 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-12427

Affected Products

Woocommerce

Yith Woocommerce Wishlist

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-12427 · Security Note
• https://t.me/CVEtracker/37694 · Telegram Post
• https://twitter.com/VolerionSec/status/1990999220065599691 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ffdb95ac-6b22-44a9-bd5c-b802a2d908d7?source=cve · Note
• https://plugins.trac.wordpress.org/browser/yith-woocommerce-wishlist/tags/4.10.0/includes/class-yith-wcwl-ajax-handler.php#L38 · Note
• https://plugins.trac.wordpress.org/browser/yith-woocommerce-wishlist/tags/4.10.0/includes/rest-api/controllers/v1/class-yith-wcwl-rest-v1-lists-controller.php#L97 · Note
• https://twitter.com/CVEnew/status/1991042922658107863 · Twitter Post
• https://plugins.trac.wordpress.org/browser/yith-woocommerce-wishlist/tags/4.10.0/includes/class-yith-wcwl-ajax-handler.php#L265 · Note
• https://plugins.trac.wordpress.org/browser/yith-woocommerce-wishlist/tags/4.10.0/includes/rest-api/controllers/v1/class-yith-wcwl-rest-v1-lists-controller.php#L56 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394933%40yith-woocommerce-wishlist%2Ftrunk&old=3379519%40yith-woocommerce-wishlist%2Ftrunk&sfp_email=&sfph_mail=#file0 · Note