CVE-2024-13694CWE-285

WooCommerce Wishlist <= 1.8.7 - Unauthenticated Wishlist Disclosure via download_pdf_file Function

High · published January 30, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
47.6
In the wild
Unconfirmed
What it is

The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.7 via the download_pdf_file() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to extract data from wishlists that they should not have access to.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00592 · 47.6th percentile
Weakness
CWE-285 · Improper Authorization
Published
2025-01-30T08:21Z
EPSS history
Timeline
  • 30 JAN 08:21Z
    WooCommerce Wishlist <= 1.8.7 - Unauthenticated Wishlist Disclosure via download_pdf_file Function
    cvelistv5