CVE-2025-11518
BaseFortify
Publication date: 2025-10-11
Last updated on: 2025-10-14
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpc | smart_wishlist | 5.0.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WPC Smart Wishlist for WooCommerce plugin for WordPress has an Insecure Direct Object Reference vulnerability in all versions up to 5.0.3. This occurs because several wishlist AJAX functions do not properly validate a user-controlled key that is exposed when wishlists are shared. As a result, unauthenticated attackers who have access to this key can manipulate other users' wishlists by adding or removing items.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to modify other users' wishlists by adding or removing products without permission. This can lead to unauthorized changes in user data, potentially causing confusion, loss of user trust, and disruption of the shopping experience on the affected WooCommerce site.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the WPC Smart Wishlist for WooCommerce plugin to version 5.0.4 or later, as this version includes fixes addressing the insecure direct object reference issue by improving validation and wishlist handling. [2]