Vulnerabilities / TI WooCommerce Wishlist / WPSEC-2026-0855
TI WooCommerce Wishlist <= 2.12.1 - Unauthenticated Sensitive Information Exposure of Private Wishlists via 'tinvwl-sharekey' Parameter
Low 3.7
CWE-200Fixed in 2.13.0
- ID
- WPSEC-2026-0855
- Plugin
- TI WooCommerce Wishlist (ti-woocommerce-wishlist)
- Affected
- all versions before 2.13.0
- Remediation
- Update to 2.13.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-13
- Attack surface
- TI WooCommerce Wishlist on WPSec AttackSurface
- Fix released
- Published
Description
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'tinvwl-sharekey' parameter of the wishlist AJAX add-to-cart actions in all versions up to, and including, 2.12.1. This is due to these actions not checking the wishlist's privacy status or the caller's ownership, combined with share keys that are only six hexadecimal characters derived from the current date and a small mt_rand() value. This makes it possible for unauthenticated attackers who guess a share key to retrieve the products in other users' private wishlists.
References
- https://wpsec.com/vuln/WPSEC-2026-0855/
- https://plugins.svn.wordpress.org/ti-woocommerce-wishlist/tags/2.13.0/
- https://wordpress.org/plugins/ti-woocommerce-wishlist/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS