5.3
Medium
CVE-2025-13440 The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up…
Description
The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to a missing capability check on the deleteWishlist() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary wishlists.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Premmerce Wishlist for WooCommerce 1.1 | earliest → 1.1.10 | No fix stated |
Other CVEs of Premmerce Wishlist for WooCommerce
The 6 CVEs of Premmerce Wishlist for WooCommerce →
CVE-2026-97273
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions
7.1
High
CVE-2026-97268
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions
7.1
High
CVE-2026-54849
Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions
9.3
Critical
CVE-2025-60191
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in…
7.5
High