Vulnerabilities / TI WooCommerce Wishlist / WPSEC-2026-1513
TI WooCommerce Wishlist <= 2.13.0 - Unauthenticated Sensitive Information Exposure of Draft and Private Product Names via 'product_id' Parameter
Medium 5.3
CWE-200Fixed in 2.14.0
- ID
- WPSEC-2026-1513
- Plugin
- TI WooCommerce Wishlist (ti-woocommerce-wishlist)
- Affected
- all versions before 2.14.0
- Remediation
- Update to 2.14.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- TI WooCommerce Wishlist on WPSec AttackSurface
- Fix released
- Published
Description
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'product_id' parameter of the add-to-wishlist request in all versions up to, and including, 2.13.0, due to the handler only rejecting trashed products and never checking that the requested product is published or readable by the current visitor. This makes it possible for unauthenticated attackers to add draft or private products to their own wishlist and read their names and SKUs from the add-to-wishlist response, along with details shown on the wishlist page.
References
- https://wpsec.com/vuln/WPSEC-2026-1513/
- https://plugins.svn.wordpress.org/ti-woocommerce-wishlist/tags/2.14.0/
- https://wordpress.org/plugins/ti-woocommerce-wishlist/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS