TI WooCommerce Wishlist <= 2.14.0 - Unauthenticated Sensitive Information Exposure of Draft and Private Product Details via WPC Product Bundles Integration
- ID
- WPSEC-2026-2398
- Plugin
- TI WooCommerce Wishlist (ti-woocommerce-wishlist)
- Affected
- all versions before 2.14.1
- Remediation
- Update to 2.14.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- TI WooCommerce Wishlist on WPSec AttackSurface
- Fix released
- Published
Description
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to Sensitive Information Exposure via the WPC Product Bundles integration in all versions up to, and including, 2.14.0. This is due to the tinvwl_row_woo_product_bundle() function rendering every product listed in the 'woosb_ids' configuration saved with a wishlist item without checking that the product is published or readable by the current user. This makes it possible for unauthenticated attackers to view the names, prices and images of draft and private products when the WPC Product Bundles plugin is active and the site has at least one published bundle product.
References
- https://wpsec.com/vuln/WPSEC-2026-2398/
- https://plugins.svn.wordpress.org/ti-woocommerce-wishlist/tags/2.14.1/
- https://wordpress.org/plugins/ti-woocommerce-wishlist/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS