# TI WooCommerce Wishlist <= 2.13.0 - Unauthenticated Sensitive Information Exposure of Draft and Private Product Names via 'product_id' Parameter

- **ID:** WPSEC-2026-1513
- **Plugin:** TI WooCommerce Wishlist (`ti-woocommerce-wishlist`), https://wordpress.org/plugins/ti-woocommerce-wishlist/
- **Affected versions:** all versions before 2.14.0
- **Fixed in:** 2.14.0 (Update to 2.14.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ti-woocommerce-wishlist
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1513/

## Description

The TI WooCommerce Wishlist plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'product_id' parameter of the add-to-wishlist request in all versions up to, and including, 2.13.0, due to the handler only rejecting trashed products and never checking that the requested product is published or readable by the current visitor. This makes it possible for unauthenticated attackers to add draft or private products to their own wishlist and read their names and SKUs from the add-to-wishlist response, along with details shown on the wishlist page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1513/
- https://plugins.svn.wordpress.org/ti-woocommerce-wishlist/tags/2.14.0/
- https://wordpress.org/plugins/ti-woocommerce-wishlist/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1513/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.