CVE-2026-124648 · Package
NO FIX YET · SEE WHAT TO DO
The TI WooCommerce Wishlist WordPress plugin does not check that a logged-out visitor owns a registered customer's wishlist before allowing changes. An attacker who knows or guesses a wishlist's share key can delete items from other customers' wishlists.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running the TI WooCommerce Wishlist plugin before 2.13.0 with wishlists enabled are exposed. The issue concerns wishlist share keys that anonymous visitors can use, so sites that do not use the wishlist feature can skip it.
Not affected if plugin-not-installed, wishlists-disabled
Who cares ti-woocommerce-wishlist, woocommerce, wordpress
ti-woocommerce-wishlist in wp-content/plugins/.2.13.0 or later.The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.