{
 "id": "WPSEC-2026-0856",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0856/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0856/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0856/index.md",
 "title": "TI WooCommerce Wishlist <= 2.12.1 - Unauthenticated Authorization Bypass to Guest Wishlist Takeover via 'tinv_wishlistkey' Cookie",
 "description": "The TI WooCommerce Wishlist plugin for WordPress is vulnerable to Authorization Bypass via the 'tinv_wishlistkey' cookie in all versions up to, and including, 2.12.1, due to guest wishlist ownership being decided only by comparing the client-supplied cookie value with the wishlist's share key. That key appears in the wishlist's share links and is a short, predictable six-character value. This makes it possible for unauthenticated attackers who know or guess a guest wishlist's share key to act as its owner: they can view the list even when it is private, remove its items through the wishlist AJAX actions, and move the list into their own account when they log in.",
 "plugin": {
  "slug": "ti-woocommerce-wishlist",
  "name": "TI WooCommerce Wishlist",
  "full_name": "TI WooCommerce Wishlist",
  "wordpress_org": "https://wordpress.org/plugins/ti-woocommerce-wishlist/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ti-woocommerce-wishlist/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ti-woocommerce-wishlist"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.13.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.13.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.13.0",
 "remediation": "Update to 2.13.0 or later.",
 "fix_released": "2026-10-12T18:49:43+00:00",
 "published": "2026-10-13T20:09:59+00:00",
 "updated": "2026-10-13T12:12:41.765861+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0856/",
  "https://plugins.svn.wordpress.org/ti-woocommerce-wishlist/tags/2.13.0/",
  "https://wordpress.org/plugins/ti-woocommerce-wishlist/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ti-woocommerce-wishlist",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-13"
 }
}