CVE-2025-13440
Missing Authorization in Premmerce Wishlist Plugin Allows Wishlist Deletion
Publication date: 2025-12-12
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| premmerce | wishlist_for_woocommerce | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the Premmerce Wishlist for WooCommerce plugin for WordPress is a Missing Authorization issue in all versions up to 1.1.10. It occurs because the deleteWishlist() function lacks a capability check, allowing authenticated users with Subscriber-level access or higher to delete arbitrary wishlists without proper permission.
How can this vulnerability impact me? :
This vulnerability allows attackers with low-level authenticated access to delete any wishlist in the system. This could lead to loss of user data and disrupt user experience by removing wishlists without authorization.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources and context do not contain information about how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if authenticated users with Subscriber-level access or higher can delete arbitrary wishlists without proper authorization. Since the vulnerability is due to a missing capability check on the deleteWishlist() function, you can test this by attempting to delete wishlists via the admin_post_premmerce_delete_wishlist action or by accessing the wishlist deletion URL parameters as a low-privilege user. There are no specific network commands provided, but monitoring HTTP requests to the wishlist deletion endpoints and verifying user permissions in WordPress admin can help detect exploitation attempts. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the wishlist deletion functionality to only trusted administrator roles by applying proper capability checks in the plugin code, especially in the deleteWishlist() function. Until a patch is available, you can disable or restrict the Premmerce Wishlist for WooCommerce plugin or remove the deleteWishlist() functionality to prevent unauthorized deletions. Monitoring and logging wishlist deletion attempts and limiting user roles that can access the wishlist management features are also recommended. [1, 3]