CVE-2024-13694 in WooCommerce Wishlist Plugin
Summary
by MITRE • 01/30/2025
The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.7 via the download_pdf_file() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to extract data from wishlists that they should not have access to.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/30/2025
The vulnerability identified as CVE-2024-13694 affects the WooCommerce Wishlist plugin for WordPress, specifically impacting versions up to and including 1.8.7. This plugin is designed for high customization with fast setup capabilities and includes Free Elementor Wishlist features, making it a popular choice among WordPress users seeking wishlist functionality. The vulnerability stems from an insecure direct object reference flaw that occurs within the download_pdf_file() function, representing a critical security weakness that undermines the plugin's access control mechanisms.
The technical flaw manifests through insufficient validation of user-controlled input parameters within the download_pdf_file() function. This function fails to properly authenticate or authorize requests before processing PDF file downloads, allowing attackers to manipulate input parameters to access wishlists they should not be permitted to view. The vulnerability operates at the application level where direct object references are used without proper access control checks, creating an opportunity for unauthorized data extraction. According to CWE-284, this represents an improper access control vulnerability where the system grants access to objects through direct references without adequate authorization verification.
The operational impact of this vulnerability is significant for WordPress sites utilizing the affected WooCommerce Wishlist plugin. Unauthenticated attackers can exploit this weakness to extract sensitive data from wishlists belonging to other users, potentially compromising user privacy and personal information. The vulnerability affects the confidentiality aspect of the CIA triad, as it enables unauthorized data disclosure without requiring any authentication credentials. This type of vulnerability can lead to privacy breaches, user data exposure, and potential identity theft scenarios when wishlists contain personal items, preferences, or other sensitive user information.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1213.002 which involves data from information repositories. The attack vector allows adversaries to leverage the insecure direct object reference to access restricted data, making it particularly dangerous for e-commerce platforms where user wishlists often contain valuable personal information. Organizations using this plugin face increased risk of data breaches and potential regulatory violations under privacy laws such as GDPR or CCPA, as unauthorized access to user data could constitute compliance violations.
Mitigation strategies should focus on implementing proper input validation and access control measures within the download_pdf_file() function. The recommended approach involves adding robust authentication checks and validating user permissions before processing any requests for wishlist data extraction. Additionally, implementing proper access control lists and ensuring that all direct object references are properly validated against user permissions will prevent unauthorized access. Organizations should immediately update to the latest version of the plugin where this vulnerability has been patched, and consider implementing additional monitoring and logging mechanisms to detect potential exploitation attempts. The fix should include proper parameter validation, authentication checks, and authorization verification to ensure that only authorized users can access specific wishlist data, thereby addressing the core insecure direct object reference issue that allows unauthenticated data extraction.