What the vulnerability does
01Description
The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.26. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to modify/update/create other user's wishlists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
The Flexible Wishlist for WooCommerce plugin versions up to 1.2.26 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions on the wishlist functionality without the admin's knowledge or consent. The vulnerability requires user interaction and does not expose sensitive data, but can modify site settings or wishlist data.
What an attacker can do
03Attacker Capabilities
Trick a logged-in admin into performing unwanted actions on the wishlist plugin via a malicious link or page.
Potential impact on your site
04Site Impact
Wishlist settings or data could be altered without your knowledge if an admin visits a compromised site.
Conditions required to exploit
05Prerequisites
Admin must visit attacker-controlled page or click a malicious link while logged into WordPress.
Key dates
06Disclosure timeline
February 18, 2025
CVE published
April 8, 2026
Record updated
