BaseFortify

Publication date: 2025-11-25

Last updated on: 2026-04-08

Assigner: Wordfence

Description

The Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.3 via several functions in class-th-wishlist-frontend.php due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to modify other user's wishlists

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-25

Last Modified

2026-04-08

Generated

2026-07-06

AI Q&A

2025-11-25

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12040

EUVD

EUVD-2025-199578

Affected Vendors & Products

Vendor	Product	Version / Range
woocommerce	woocommerce	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

The vulnerability in the Wishlist for WooCommerce plugin for WordPress is an Insecure Direct Object Reference (IDOR) issue present in all versions up to and including 1.0.9. It occurs due to missing validation on a user-controlled key in several functions within the class-th-wishlist-frontend.php file. This flaw allows unauthenticated attackers to modify other users' wishlists.

Impact Analysis

This vulnerability can allow unauthenticated attackers to modify other users' wishlists, potentially leading to unauthorized changes to user data. This could result in loss of data integrity and trust, and may affect user experience and the security of user-specific information.

Hi! I’m here to help you understand CVE-2025-12040. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70