Insecure Direct Object Reference in WooCommerce Wishlist Plugin by WordPress
CVE-2024-13694

7.5HIGH

Key Information:

Vendor
WordPress
Status
WooCommerce Wishlist (high Customization, Fast Setup,free Elementor Wishlist, Most Features)
Vendor
CVE Published:
30 January 2025

Summary

The WooCommerce Wishlist plugin for WordPress is susceptible to an Insecure Direct Object Reference vulnerability that affects all versions up to and including 1.8.7. The flaw exists in the download_pdf_file() function, where absent validation on a user-controlled key permits unauthenticated attackers to potentially access and extract sensitive data from user wishlists. This vulnerability highlights the importance of proper input validation and security measures in web applications to prevent unauthorized data exposure.

Affected Version(s)

WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) * <= 1.8.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/smart-wishlist-for-more-con...
https://plugins.trac.wordpress.org/browser/smart-wishlist...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tim Coen
.