{"id":"CVE-2026-119511","kind":"vulnerability","aliases":["CVE-2026-119511"],"related":[],"title":"WooCommerce Wishlist plugin: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.","summary":"The MC Woocommerce Wishlist WordPress plugin (smart-wishlist-for-more-convert) has a missing authorization check, so access control settings can be exploited. The advisory states the issue affects versions through 2.0.3.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wishlist-plugin","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the MC Woocommerce Wishlist plugin (smart-wishlist-for-more-convert) in the WordPress admin under Plugins; affected if it is `2.0.3` or earlier.","fix":null,"status":"open","published_at":"2026-11-07T10:17:09+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","triaged_at":"2026-11-07T10:48:45+00:00","updated_at":"2026-11-07T10:48:45+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-07T10:48:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WooCommerce Wishlist plugin: missing authorization lets users bypass access controls","impact":"low","summary":"The MC Woocommerce Wishlist WordPress plugin (smart-wishlist-for-more-convert) has a missing authorization check, so access control settings can be exploited. The advisory states the issue affects versions through 2.0.3.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","wishlist-plugin"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to wishlist functions or data by unauthorized users","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the exact unauthorized action allowed.","how_to_check":"- Check the installed version of the MC Woocommerce Wishlist plugin (smart-wishlist-for-more-convert) in the WordPress admin under Plugins; affected if it is `2.0.3` or earlier.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Stores running WordPress with the MC Woocommerce Wishlist plugin version 2.0.3 or earlier are in scope. The sources do not describe the specific configuration needed to trigger the flaw, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4236,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119511':13A,16A '-2026':12A,15A '2.0.3':55B,86C 'access':9A,41B,74C 'advisori':48B 'affect':52B,79C 'allow':70C 'author':5A,38B,57C 'bypass':8A 'check':39B 'configur':73C 'control':10A,42B,75C 'convert':34B,69C 'cve':11A,14A 'exploit':46B,71C 'incorrect':72C 'issu':51B,78C 'let':6A 'levels.this':77C 'mc':24B,61C,80C 'miss':4A,37B,56C 'n/a':84C 'packag':17B 'plugin':3A,20B,28B 'saeed':60C 'secur':76C 'set':43B 'smart':30B,65C 'smart-wishlist-for-more-convert':29B,64C 'state':49B 'user':7A 'version':53B 'vulner':58C 'wishlist':2A,19B,26B,31B,63C,66C,82C 'wishlist-plugin':18B 'woocommerc':1A,21B,25B,62C,81C 'wordpress':22B,27B","nicknames":[],"mitigations":[],"who_affected":"Stores running WordPress with the MC Woocommerce Wishlist plugin version 2.0.3 or earlier are in scope. The sources do not describe the specific configuration needed to trigger the flaw, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wishlistplugin","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-119511':13A,16A '-2026':12A,15A 'access':9A 'author':5A 'bypass':8A 'control':10A 'cve':11A,14A 'let':6A 'miss':4A 'plugin':3A 'user':7A 'wishlist':2A 'woocommerc':1A","search_b":"'2.0.3':55B 'access':41B 'advisori':48B 'affect':52B 'author':38B 'check':39B 'control':42B 'convert':34B 'exploit':46B 'issu':51B 'mc':24B 'miss':37B 'packag':17B 'plugin':20B,28B 'set':43B 'smart':30B 'smart-wishlist-for-more-convert':29B 'state':49B 'version':53B 'wishlist':19B,26B,31B 'wishlist-plugin':18B 'woocommerc':21B,25B 'wordpress':22B,27B","search_c":"'2.0.3':86C 'access':74C 'affect':79C 'allow':70C 'author':57C 'configur':73C 'control':75C 'convert':69C 'exploit':71C 'incorrect':72C 'issu':78C 'levels.this':77C 'mc':61C,80C 'miss':56C 'n/a':84C 'saeed':60C 'secur':76C 'smart':65C 'smart-wishlist-for-more-convert':64C 'vulner':58C 'wishlist':63C,66C,82C 'woocommerc':62C,81C","first_public_at":"2026-11-07T10:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119511","severity":null,"published_at":"2026-11-07T10:17:09+00:00","modified_at":"2026-11-07T10:17:09+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","fetched_at":"2026-11-07T10:46:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}