CVE-2026-15261 in TI WooCommerce Wishlist Plugin
Summary
by MITRE • 10/22/2026
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in versions of the TI WooCommerce Wishlist plugin prior to 2.13.0 represents a critical failure in server-side access control mechanisms within WordPress REST API endpoints. This flaw stems from an inconsistency between how permissions are enforced on the public-facing front-end interface versus those applied to programmatic API requests. In typical web application architectures, developers often implement security checks at the presentation layer for user interfaces while assuming that backend APIs inherit these protections or rely solely on authentication tokens without verifying resource ownership. However, in this specific implementation, the REST API endpoints responsible for retrieving wishlist data do not adequately validate whether the requesting user is the legitimate owner of the target wishlist. This architectural oversight allows any unauthenticated actor to bypass intended privacy restrictions by directly querying the API with known identifiers or through enumeration techniques.
From a technical perspective, the core issue lies in the absence of proper authorization checks within the REST controller logic. When an authenticated WordPress session exists but lacks specific permissions for private resources, or when no authentication is provided at all depending on how the plugin registers its routes, the system fails to cross-reference the user identity against the ownership metadata stored in the database. Consequently, sensitive data structures containing wishlist items are returned without verifying that the requester has explicit permission to view them. This type of flaw is classically categorized under CWE-284 Improper Access Control and specifically aligns with CWE-639 Authorization Bypass Through User-Controlled Key if an attacker can manipulate identifiers to access other users' data, or more broadly as a form of Insecure Direct Object Reference where the application exposes internal implementation details by failing to enforce proper checks on user input.
The operational impact of this vulnerability is significant for both individual consumers and e-commerce businesses utilizing WordPress with WooCommerce. Private wishlists are often used by shoppers to save items they intend to purchase later, potentially including high-value goods or personal preferences that should remain confidential. An unauthenticated attacker can exploit this flaw to scrape these lists en masse if the API endpoints allow pagination or bulk retrieval without rate limiting. This leads to a direct compromise of user privacy and confidentiality. Furthermore, attackers could use the harvested data for targeted phishing campaigns, social engineering attacks, or competitive intelligence gathering by analyzing purchasing trends and preferences of specific individuals or groups. The exposure of such metadata undermines trust in the platform and violates principles of data minimization and access control mandated by various compliance frameworks including GDPR which requires strict controls over personal data processing.
Mitigation strategies must focus on enforcing consistent authorization logic across all entry points to the application's backend services. Developers should ensure that every REST API endpoint performs a rigorous check verifying that the current user context matches the owner of the requested resource before returning any sensitive information. This involves implementing middleware or hooks in WordPress that validate ownership claims against session data or authentication tokens regardless of whether the request originates from a browser interface or an API call. Additionally, applying principle of least privilege ensures that default permissions for private resources are set to deny access unless explicitly granted. For administrators using affected versions, immediate updating to version 2.13.0 or later is required as this release addresses these authorization gaps by aligning REST API behavior with front-end security standards. Until patches are applied, implementing Web Application Firewall rules that restrict access to specific WooCommerce endpoints based on IP reputation or behavioral anomalies can provide a temporary layer of defense against automated exploitation attempts associated with ATT&CK technique T1506 Data Collection from Cloud Storage or similar data harvesting tactics.