Insecure Direct Object Reference in Wishlist and Save for Later for Woocommerce Plugin by WordPress

CVE-2025-12087

What is CVE-2025-12087?

The Wishlist and Save for Later for Woocommerce plugin for WordPress is susceptible to an Insecure Direct Object Reference. This vulnerability allows authenticated attackers, including those with Subscriber-level access, to manipulate a user-controlled key through the 'awwlm_remove_added_wishlist_page' AJAX action. As a consequence, these attackers can delete wishlist items from other users' wishlists, presenting a significant security risk and potential data loss for users relying on this functionality.

References