Executive Summary

The vulnerability in the Premmerce Wishlist for WooCommerce plugin for WordPress is a Missing Authorization issue in all versions up to 1.1.10. It occurs because the deleteWishlist() function lacks a capability check, allowing authenticated users with Subscriber-level access or higher to delete arbitrary wishlists without proper permission.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with low-level authenticated access to delete any wishlist in the system. This could lead to loss of user data and disrupt user experience by removing wishlists without authorization.

Useful 0 Not Useful 0

Compliance Impact

The provided resources and context do not contain information about how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if authenticated users with Subscriber-level access or higher can delete arbitrary wishlists without proper authorization. Since the vulnerability is due to a missing capability check on the deleteWishlist() function, you can test this by attempting to delete wishlists via the admin_post_premmerce_delete_wishlist action or by accessing the wishlist deletion URL parameters as a low-privilege user. There are no specific network commands provided, but monitoring HTTP requests to the wishlist deletion endpoints and verifying user permissions in WordPress admin can help detect exploitation attempts. [1, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the wishlist deletion functionality to only trusted administrator roles by applying proper capability checks in the plugin code, especially in the deleteWishlist() function. Until a patch is available, you can disable or restrict the Premmerce Wishlist for WooCommerce plugin or remove the deleteWishlist() functionality to prevent unauthorized deletions. Monitoring and logging wishlist deletion attempts and limiting user roles that can access the wishlist management features are also recommended. [1, 3]

Useful 0 Not Useful 0