4.3
Medium
CVE-2025-11742 The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a…
Description
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wishlist_quickview' AJAX action in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's wishlist data and information.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPC Smart Wishlist for WooCommerce 5.0 | earliest → 5.0.4 | No fix stated |
Other CVEs of WPC Smart Wishlist for WooCommerce
The 4 CVEs of WPC Smart Wishlist for WooCommerce →
CVE-2026-32407
Missing Authorization vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist allows…
4.3
Medium
CVE-2025-11518
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all…
5.3
Medium
CVE-2023-34386
Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Smart Wishlist for WooCommerce plugin <= 4.7.1 versions
4.3
Medium