Insecure Direct Object Reference in YITH WooCommerce Wishlist Plugin for WordPress

CVE-2025-12427

What is CVE-2025-12427?

The YITH WooCommerce Wishlist plugin for WordPress is compromised by missing validation on user-controlled keys, allowing unauthenticated attackers to exploit the REST API endpoint and AJAX handler. This vulnerability enables attackers to access any user's wishlist token ID, leading to potential unauthorized actions such as renaming wishlists. This risk poses a significant threat to multi-user eCommerce environments, potentially facilitating defacement, social engineering, mass tampering, and extensive user profiling.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References