Skip to content
Sign in
5.3 Medium

CVE-2026-15261 The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its…

Description

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.

Affected products and versions

Product Affected versions Fixed in
TI WooCommerce Wishlist 2.13 earliest → < 2.13.0 2.13.0

Other CVEs of TI WooCommerce Wishlist

The 2 CVEs of TI WooCommerce Wishlist →
CVE-2024-9156 The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping… 5.9 Medium
Track this CVE