Lifecycle Timeline
2DescriptionNVD
Missing Authorization vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wishlist for WooCommerce: from n/a through <= 3.2.3.
AnalysisAI
Missing authorization in WPFactory Wishlist for WooCommerce through version 3.2.3 allows unauthenticated attackers to exploit incorrectly configured access controls to perform unauthorized actions on wishlists. The vulnerability stems from broken access control mechanisms (CWE-862) that fail to properly validate user permissions before granting access to sensitive wish-list functionality. With an EPSS score of 0.07% (22nd percentile), real-world exploitation likelihood is currently low, but the issue affects a popular WooCommerce plugin used across numerous e-commerce sites.
Technical ContextAI
WPFactory Wishlist for WooCommerce is a WordPress plugin (CPE context: WordPress plugins extending WooCommerce functionality) that manages customer wish lists in e-commerce environments. The vulnerability involves CWE-862 (Missing Authorization), which describes scenarios where an application fails to perform proper authorization checks before allowing access to protected resources or operations. In WordPress plugin architecture, this typically manifests as missing or insufficient checks on capability functions (is_user_logged_in(), current_user_can()) or REST API endpoints lacking proper permission callbacks. The plugin's access control layer does not adequately validate whether the requesting user has legitimate permission to view, modify, or interact with wish-list data belonging to other users or accounts.
Affected ProductsAI
Wishlist for WooCommerce by WPFactory is affected in all versions from the beginning through and including version 3.2.3. The plugin extends WooCommerce functionality within WordPress environments. Affected users can identify their version through the WordPress admin plugin dashboard (Plugins > Installed Plugins). Patchstack documentation references this vulnerability for the plugin family wish-list-for-woocommerce.
RemediationAI
Update Wishlist for WooCommerce to version 3.2.4 or later, which contains the authorization fix. Users should navigate to WordPress admin > Plugins > Installed Plugins, locate Wishlist for WooCommerce, and click "Update now" if available, or manually download the patched version from the WordPress plugin repository. If an immediate update is not feasible, disable the plugin temporarily to eliminate exposure surface. Verify through WooCommerce settings and wish-list functionality that the update has resolved the authorization checks. Consult the Patchstack vulnerability database (https://patchstack.com/database/Wordpress/Plugin/wish-list-for-woocommerce/) for vendor advisory details and confirmation of the patched version availability.
Share
External POC / Exploit Code
Leaving vuln.today