← CVE Intelligence

CVE-2026-15261

TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_key PUBLISHED

Description (CNA)

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.

Affected (CNA)

Vendor / productVersions
Unknown / TI WooCommerce Wishlistaffected 0 before 2.13.0

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.