Unauthorized Wishlist Management in TI WooCommerce Wishlist Plugin by WordPress
CVE-2026-124648

Currently unrated

Key Information:

Vendor

WordPress
Status
Ti WooCommerce Wishlist
Vendor
CVE Published:
12 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-124648?

The TI WooCommerce Wishlist plugin for WordPress is vulnerable due to insufficient verification of wishlist ownership. This flaw allows unauthenticated users to manipulate registered users' wishlists by deleting items without authorization, given they know or can guess a wishlist's share key. This poses a significant risk to user privacy and data integrity, necessitating immediate attention and updates to mitigate unauthorized access.

Affected Version(s)

TI WooCommerce Wishlist 0 < 2.13.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-124648 - Proof of Concept

References

https://wpscan.com/vulnerability/528218ee-f437-4028-aae0-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ángel Santana
WPScan
.