# TI WooCommerce Wishlist <= 2.12.1 - Unauthenticated Sensitive Information Exposure of Private Wishlists via 'tinvwl-sharekey' Parameter

- **ID:** WPSEC-2026-0855
- **Plugin:** TI WooCommerce Wishlist (`ti-woocommerce-wishlist`), https://wordpress.org/plugins/ti-woocommerce-wishlist/
- **Affected versions:** all versions before 2.13.0
- **Fixed in:** 2.13.0 (Update to 2.13.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ti-woocommerce-wishlist
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0855/

## Description

The TI WooCommerce Wishlist plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'tinvwl-sharekey' parameter of the wishlist AJAX add-to-cart actions in all versions up to, and including, 2.12.1. This is due to these actions not checking the wishlist's privacy status or the caller's ownership, combined with share keys that are only six hexadecimal characters derived from the current date and a small mt_rand() value. This makes it possible for unauthenticated attackers who guess a share key to retrieve the products in other users' private wishlists.

## References

- https://wpsec.com/vuln/WPSEC-2026-0855/
- https://plugins.svn.wordpress.org/ti-woocommerce-wishlist/tags/2.13.0/
- https://wordpress.org/plugins/ti-woocommerce-wishlist/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0855/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.