TI WooCommerce Wishlist CVE-2026-15261

No authentication, user interaction, or special privilege is required - exploitation works against a default installation of TI WooCommerce Wishlist (versions before 2.13.0) simply by querying its REST API endpoints directly instead of the front-end. The specific prerequisite is that the target site runs the vulnerable plugin version and that the attacker can reference private wishlists (e.g., by their identifiers); the only real limit on impact is that exposure is confined to wishlist metadata and item contents, not broader site or user-credential data. No non-default configuration is needed to trigger the flaw.

All signals describe a broken-access-control information-disclosure flaw (CWE-284) of moderate severity. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 Medium) is internally consistent with the description: the REST API is reachable remotely by unauthenticated users with no interaction, but impact is limited to confidentiality (C:L) with no integrity or availability effect - it only leaks private wishlist metadata and item contents, not credentials or system data. Publicly available exploit code exists (reported by WPScan), which raises practical exploitability, but this vulnerability is NOT in CISA KEV and no EPSS score was provided in the input, so there is no confirmation of active, widespread exploitation. The realistic picture is a genuine, easily-triggered privacy/data-exposure bug rather than a system-compromise emergency: low technical impact caps the ceiling. Note a conflict to verify: the input Tags label this 'Authentication Bypass,' but the description and CWE-284 indicate an authorization (owner-only access control) failure on the REST API, not an authentication bypass - the distinction matters for triage. EPSS and SSVC data were not supplied, so automatability and exploitation-likelihood scoring could not be incorporated.

An unauthenticated attacker enumerates or guesses wishlist identifiers and sends direct requests to the plugin's REST API endpoints, which - unlike the front-end - fail to enforce the owner-only check. The API returns the metadata and item contents of other users' private wishlists, exposing their saved products and associated data. Publicly available exploit code (WPScan) lowers the skill barrier to carry this out at scale.