WPC Smart Wishlist CVE-2025-11518

Exploitation requires that a victim has shared their wishlist, which exposes a user-controlled wishlist key, and that the attacker obtains that specific key; with the key, an unauthenticated attacker can invoke the affected wishlist AJAX functions (add/empty) against the victim's wishlist in WPC Smart Wishlist for WooCommerce versions up to and including 5.0.3. The primary limiting factor is the need to acquire the shared key - wishlists that are never shared are not exposed - so this is not blanket remote exploitation of default installs. Impact is confined to integrity of wishlist contents (adding items or emptying the list); there is no confidentiality or availability impact and no code execution.

This is a genuine but low-severity authorization flaw, not a high-priority emergency. The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects a network-reachable, unauthenticated issue with only limited integrity impact and no confidentiality or availability impact - consistent with CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR). The EPSS score of 0.23% (13th percentile) indicates very low predicted exploitation probability, there is no CISA KEV listing, and no public exploit code was identified in the provided data, so there is no evidence of active or widespread exploitation. The signals are mutually consistent rather than conflicting: low impact, low EPSS, and absent KEV all point to a nuisance-grade authorization bug rather than a critical breach vector. One caveat to verify with the vendor: the CVSS vector marks PR:N (unauthenticated) and AC:L (low complexity), yet the description states exploitation is only possible 'if they have access to the key' exposed during wishlist sharing - this prerequisite arguably raises real-world attack complexity and tempers the raw AC:L reading. The 'Authentication Bypass' tag is also imprecise; per CWE-639 this is an authorization/access-control (IDOR) weakness, not an authentication bypass.

A user shares their WooCommerce wishlist, exposing the user-controlled key in the share link or page. An attacker who obtains that key sends crafted requests to the vulnerable wishlist AJAX endpoints to add items to or empty the victim's wishlist without authentication. No public proof-of-concept exploit was identified in the provided data, and impact is limited to tampering with wishlist contents (integrity only).