Live › vulnerability › CVE-2026-15261
Go to dashboardThe TI WooCommerce Wishlist WordPress plugin before 2.13.0 applies an owner-only check on the front end but not on its REST API. An unauthenticated visitor can read the metadata and item contents of other users' private wishlists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the TI WooCommerce Wishlist plugin before 2.13.0 on a WooCommerce store where customers keep private wishlists. The exposure is the REST API, so a site that has the plugin but does not use wishlists still exposes the endpoints. Sites without the plugin or already on 2.13.0 or later are not affected.
No product ranges from the sources yet.
2.13.0.2.13.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.
This page as .md · .json · in your agent: get_signal("CVE-2026-15261")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.