Wpc Smart Wishlist For Woocommerce CVE-2026-32407

The risk profile reflects a moderate real-world threat with several mitigating factors. The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates network accessibility, low attack complexity, and requirement for low-privilege authentication, with limited integrity impact and no confidentiality or availability impact—a classic authorization flaw. The low CVSS does not diminish severity because authorization bypasses often have asymmetric impact: while the CVSS captures only integrity degradation for wishlist data, the reputational and trust damage to e-commerce platforms can be substantial. Without access to EPSS, KEV status, or public POC availability data from external intelligence sources, the practical exploitability cannot be precisely quantified; however, authorization bugs in widely-used e-commerce plugins are frequently discovered and disclosed, suggesting moderate to high likelihood of exploitation by threat actors targeting WooCommerce installations. The authentication requirement (PR:L) reduces attack surface compared to unauthenticated vulnerabilities, as an attacker must first register or compromise a user account. This vulnerability should be prioritized for patching on public-facing e-commerce sites but does not constitute a critical emergency comparable to pre-auth remote code execution flaws.

An attacker with a valid WooCommerce customer account (obtained through free registration or account compromise) sends an authenticated HTTP request to a wishlist management endpoint, directly modifying the user ID or wishlist ID parameter to target another customer's wishlist. Due to missing server-side authorization checks, the request succeeds, allowing the attacker to add/remove items from a target customer's wishlist or view their wishlist contents. The attack requires low complexity and no user interaction; the attacker can automate exploitation across multiple customer accounts to disrupt service or gather competitive intelligence on customer preferences. No public POC or KEV status data is presently available, but the straightforward nature of authorization bypass exploits means proof-of-concept code could be rapidly developed once the vulnerability details are disclosed.