Authorization Bypass in YITH WooCommerce Wishlist Plugin for WordPress

CVE-2025-12777

What is CVE-2025-12777?

The YITH WooCommerce Wishlist plugin allows unauthenticated users to exploit an authorization bypass vulnerability affecting the REST API and AJAX handlers. This flaw enables attackers to access wishlist tokens of any user and potentially delete items from shared wishlists. The vulnerability arises from insufficient checks in the permission callback for the REST API endpoint and inadequate nonce verification for object-level actions, putting user data at risk.

References