Insecure Direct Object Reference in QODE Wishlist Plugin for WooCommerce

CVE-2025-13157

What is CVE-2025-13157?

The QODE Wishlist for WooCommerce plugin for WordPress exhibits a vulnerability that allows unauthenticated attackers to exploit the 'qode_wishlist_for_woocommerce_wishlist_table_item_callback' function. This is due to a lack of proper validation on a user-controlled key, enabling unauthorized modifications to the public view of wishlists. This flaw can lead to unauthorized access to sensitive user data and manipulation of wishlist contents, posing significant security risks for users relying on this plugin.

References