TI WooCommerce Wishlist <= 2.12.1 - Unauthenticated Authorization Bypass to Guest Wishlist Takeover via 'tinv_wishlistkey' Cookie
- ID
- WPSEC-2026-0856
- Plugin
- TI WooCommerce Wishlist (ti-woocommerce-wishlist)
- Affected
- all versions before 2.13.0
- Remediation
- Update to 2.13.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-13
- Attack surface
- TI WooCommerce Wishlist on WPSec AttackSurface
- Fix released
- Published
Description
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to Authorization Bypass via the 'tinv_wishlistkey' cookie in all versions up to, and including, 2.12.1, due to guest wishlist ownership being decided only by comparing the client-supplied cookie value with the wishlist's share key. That key appears in the wishlist's share links and is a short, predictable six-character value. This makes it possible for unauthenticated attackers who know or guess a guest wishlist's share key to act as its owner: they can view the list even when it is private, remove its items through the wishlist AJAX actions, and move the list into their own account when they log in.
References
- https://wpsec.com/vuln/WPSEC-2026-0856/
- https://plugins.svn.wordpress.org/ti-woocommerce-wishlist/tags/2.13.0/
- https://wordpress.org/plugins/ti-woocommerce-wishlist/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS