{
 "id": "WPSEC-2026-0855",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0855/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0855/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0855/index.md",
 "title": "TI WooCommerce Wishlist <= 2.12.1 - Unauthenticated Sensitive Information Exposure of Private Wishlists via 'tinvwl-sharekey' Parameter",
 "description": "The TI WooCommerce Wishlist plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'tinvwl-sharekey' parameter of the wishlist AJAX add-to-cart actions in all versions up to, and including, 2.12.1. This is due to these actions not checking the wishlist's privacy status or the caller's ownership, combined with share keys that are only six hexadecimal characters derived from the current date and a small mt_rand() value. This makes it possible for unauthenticated attackers who guess a share key to retrieve the products in other users' private wishlists.",
 "plugin": {
  "slug": "ti-woocommerce-wishlist",
  "name": "TI WooCommerce Wishlist",
  "full_name": "TI WooCommerce Wishlist",
  "wordpress_org": "https://wordpress.org/plugins/ti-woocommerce-wishlist/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ti-woocommerce-wishlist/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ti-woocommerce-wishlist"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.13.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.13.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.13.0",
 "remediation": "Update to 2.13.0 or later.",
 "fix_released": "2026-10-12T18:49:43+00:00",
 "published": "2026-10-13T20:09:59+00:00",
 "updated": "2026-10-13T12:12:41.765861+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0855/",
  "https://plugins.svn.wordpress.org/ti-woocommerce-wishlist/tags/2.13.0/",
  "https://wordpress.org/plugins/ti-woocommerce-wishlist/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ti-woocommerce-wishlist",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-13"
 }
}