Description
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | TI WooCommerce Wishlist | < 2.13.0 | 2.13.0 |
References
- https://wpscan.com/vulnerability/528218ee-f437-4028-aae0-022435cbb66e/ exploit vdb-entry technical-description