Insecure Direct Object Reference in YITH WooCommerce Wishlist Plugin for WordPress

CVE-2025-12427

What is CVE-2025-12427?

The YITH WooCommerce Wishlist plugin for WordPress is compromised by missing validation on user-controlled keys, allowing unauthenticated attackers to exploit the REST API endpoint and AJAX handler. This vulnerability enables attackers to access any user's wishlist token ID, leading to potential unauthorized actions such as renaming wishlists. This risk poses a significant threat to multi-user eCommerce environments, potentially facilitating defacement, social engineering, mass tampering, and extensive user profiling.

References