Vulnerability · Published Oct 11, 2025 · Assigned by Wordfence
CVE-2025-11518WPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Medium 5.3
In plain English
A medium-severity authorization bypass via user-controlled key in WPC Smart Wishlist for WooCommerce from wpclever. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via several wishlist AJAX functions due to missing validation on a user controlled key that is exposed when wishlists are shared. This makes it possible for unauthenticated attackers to empty and add to other user's wishlists, if they have access to the key.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpclever | WPC Smart Wishlist for WooCommerce | 0 – through 5.0.3 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N