{
 "id": "WPSEC-2026-2398",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2398/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2398/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2398/index.md",
 "title": "TI WooCommerce Wishlist <= 2.14.0 - Unauthenticated Sensitive Information Exposure of Draft and Private Product Details via WPC Product Bundles Integration",
 "description": "The TI WooCommerce Wishlist plugin for WordPress is vulnerable to Sensitive Information Exposure via the WPC Product Bundles integration in all versions up to, and including, 2.14.0. This is due to the tinvwl_row_woo_product_bundle() function rendering every product listed in the 'woosb_ids' configuration saved with a wishlist item without checking that the product is published or readable by the current user. This makes it possible for unauthenticated attackers to view the names, prices and images of draft and private products when the WPC Product Bundles plugin is active and the site has at least one published bundle product.",
 "plugin": {
  "slug": "ti-woocommerce-wishlist",
  "name": "TI WooCommerce Wishlist",
  "full_name": "TI WooCommerce Wishlist",
  "wordpress_org": "https://wordpress.org/plugins/ti-woocommerce-wishlist/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ti-woocommerce-wishlist/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ti-woocommerce-wishlist"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.14.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.14.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.14.1",
 "remediation": "Update to 2.14.1 or later.",
 "fix_released": "2026-11-02T14:53:06+00:00",
 "published": "2026-11-03T15:50:58+00:00",
 "updated": "2026-11-03T13:19:26.368459+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2398/",
  "https://plugins.svn.wordpress.org/ti-woocommerce-wishlist/tags/2.14.1/",
  "https://wordpress.org/plugins/ti-woocommerce-wishlist/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ti-woocommerce-wishlist",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}