5.3
Medium
CVE-2025-11518 The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all…
Description
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via several wishlist AJAX functions due to missing validation on a user controlled key that is exposed when wishlists are shared. This makes it possible for unauthenticated attackers to empty and add to other user's wishlists, if they have access to the key.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPC Smart Wishlist for WooCommerce 5.0 | earliest → 5.0.3 | No fix stated |
Other CVEs of WPC Smart Wishlist for WooCommerce
The 4 CVEs of WPC Smart Wishlist for WooCommerce →
CVE-2026-32407
Missing Authorization vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist allows…
4.3
Medium
CVE-2025-11742
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a…
4.3
Medium
CVE-2023-34386
Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Smart Wishlist for WooCommerce plugin <= 4.7.1 versions
4.3
Medium