CVE-2025-12040CWE-639

CVE-2025-12040

Medium · published November 25, 2025

CVSS v3.1

6.5

EPSS

Percentile

13.9

In the wild

Unconfirmed

What it is

The Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.3 via several functions in class-th-wishlist-frontend.php due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to modify other user's wishlists

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00237 · 13.9th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2025-11-25T13:15Z

References (3)

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3402486%40th-wishlist&new=3402486%40th-wishlist&sfp_email=&sfph_mail= · [email protected]https://wordpress.org/plugins/th-wishlist/ · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/6d7c8f79-4dfd-4d6f-b533-dc7a5998dfc1?source=cve · [email protected]

EPSS history

Timeline

25 NOV 07:28Z
Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
cvelistv5