Unrated severityNVD Advisory· Published Nov 12, 2026

CVE-2026-124648

Description

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Ti Woocommerce Wishlistllm-fuzzy
Range: <2.13.0
Package: https://wordpress.org/plugins/ti-woocommerce-wishlist

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/528218ee-f437-4028-aae0-022435cbb66e/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000