# TI WooCommerce Wishlist <= 2.14.0 - Unauthenticated Sensitive Information Exposure of Draft and Private Product Details via WPC Product Bundles Integration

- **ID:** WPSEC-2026-2398
- **Plugin:** TI WooCommerce Wishlist (`ti-woocommerce-wishlist`), https://wordpress.org/plugins/ti-woocommerce-wishlist/
- **Affected versions:** all versions before 2.14.1
- **Fixed in:** 2.14.1 (Update to 2.14.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ti-woocommerce-wishlist
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2398/

## Description

The TI WooCommerce Wishlist plugin for WordPress is vulnerable to Sensitive Information Exposure via the WPC Product Bundles integration in all versions up to, and including, 2.14.0. This is due to the tinvwl_row_woo_product_bundle() function rendering every product listed in the 'woosb_ids' configuration saved with a wishlist item without checking that the product is published or readable by the current user. This makes it possible for unauthenticated attackers to view the names, prices and images of draft and private products when the WPC Product Bundles plugin is active and the site has at least one published bundle product.

## References

- https://wpsec.com/vuln/WPSEC-2026-2398/
- https://plugins.svn.wordpress.org/ti-woocommerce-wishlist/tags/2.14.1/
- https://wordpress.org/plugins/ti-woocommerce-wishlist/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2398/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.