CVE-2025-12087CWE-639

CVE-2025-12087

Medium · published November 12, 2025

CVSS v3.1

4.3

EPSS

Percentile

9.5

In the wild

Unconfirmed

What it is

The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.22 via the 'awwlm_remove_added_wishlist_page' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete wishlist items from other user's wishlists.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00201 · 9.5th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2025-11-12T10:15Z

References (2)

https://plugins.trac.wordpress.org/log/aco-wishlist-for-woocommerce/ · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/17e8a743-7985-4b28-b854-ac052a834f3a?source=cve · [email protected]

EPSS history

Timeline

12 NOV 04:29Z
Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion
cvelistv5