{"id":"CVE-2026-124648","kind":"vulnerability","aliases":["CVE-2026-124648"],"related":[],"title":"WooCommerce Wishlist plugin lets guests delete items from other wishlists","description":"The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists.","summary":"The TI WooCommerce Wishlist WordPress plugin does not check that a logged-out visitor owns a registered customer's wishlist before allowing changes. An attacker who knows or guesses a wishlist's share key can delete items from other customers' wishlists.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","ti-woocommerce-wishlist","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","wishlists-disabled"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Look for the plugin folder `ti-woocommerce-wishlist` in `wp-content/plugins/`.","fix":"- TI WooCommerce Wishlist: move to `2.13.0` or later.","status":"open","published_at":"2026-11-12T06:17:13+00:00","first_seen_at":"2026-11-12T06:36:53+00:00","triaged_at":"2026-11-12T06:37:52+00:00","updated_at":"2026-11-12T06:37:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T06:37:52Z","model":"claude-haiku-5-5","output":{"fix":"- TI WooCommerce Wishlist: move to `2.13.0` or later.","reach":"internet","title":"WooCommerce Wishlist plugin lets guests delete items from other wishlists","impact":"low","summary":"The TI WooCommerce Wishlist WordPress plugin does not check that a logged-out visitor owns a registered customer's wishlist before allowing changes. An attacker who knows or guesses a wishlist's share key can delete items from other customers' wishlists.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","ti-woocommerce-wishlist"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"anonymous visitors delete items from other customers' wishlists","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Look for the plugin folder `ti-woocommerce-wishlist` in `wp-content/plugins/`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","wishlists-disabled"],"who_is_affected":"Stores running the TI WooCommerce Wishlist plugin before 2.13.0 with wishlists enabled are exposed. The issue concerns wishlist share keys that anonymous visitors can use, so sites that do not use the wishlist feature can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4555,"output_tokens":542,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124648':13A,16A '-2026':12A,15A '2.13.0':73C 'allow':46B,96C 'attack':49B 'chang':47B 'check':32B 'custom':42B,64B,113C 'cve':11A,14A 'delet':6A,60B,109C 'guess':53B,102C 'guest':5A 'item':7A,61B,110C 'key':58B,107C 'know':51B,100C 'let':4A,92C 'log':36B,83C 'logged-out':35B 'manag':94C 'own':39B,85C 'packag':17B 'plugin':3A,29B,71C 'regist':41B,87C 'share':57B,106C 'ti':19B,25B,67C 'ti-woocommerce-wishlist':18B 'unauthent':97C 'user':88C,98C 'verifi':76C 'visitor':38B,79C 'wishlist':2A,10A,21B,27B,44B,55B,65B,69C,90C,104C,114C 'woocommerc':1A,20B,22B,26B,68C 'wordpress':23B,28B,70C","nicknames":[],"mitigations":[],"who_affected":"Stores running the TI WooCommerce Wishlist plugin before 2.13.0 with wishlists enabled are exposed. The issue concerns wishlist share keys that anonymous visitors can use, so sites that do not use the wishlist feature can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","tiwoocommercewishlist","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-124648':13A,16A '-2026':12A,15A 'cve':11A,14A 'delet':6A 'guest':5A 'item':7A 'let':4A 'plugin':3A 'wishlist':2A,10A 'woocommerc':1A","search_b":"'allow':46B 'attack':49B 'chang':47B 'check':32B 'custom':42B,64B 'delet':60B 'guess':53B 'item':61B 'key':58B 'know':51B 'log':36B 'logged-out':35B 'own':39B 'packag':17B 'plugin':29B 'regist':41B 'share':57B 'ti':19B,25B 'ti-woocommerce-wishlist':18B 'visitor':38B 'wishlist':21B,27B,44B,55B,65B 'woocommerc':20B,22B,26B 'wordpress':23B,28B","search_c":"'2.13.0':73C 'allow':96C 'custom':113C 'delet':109C 'guess':102C 'item':110C 'key':107C 'know':100C 'let':92C 'log':83C 'manag':94C 'own':85C 'plugin':71C 'regist':87C 'share':106C 'ti':67C 'unauthent':97C 'user':88C,98C 'verifi':76C 'visitor':79C 'wishlist':69C,90C,104C,114C 'woocommerc':68C 'wordpress':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124648","severity":null,"published_at":"2026-11-12T06:17:13+00:00","modified_at":"2026-11-12T06:17:13+00:00","first_seen_at":"2026-11-12T06:36:53+00:00","fetched_at":"2026-11-12T06:36:53+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}