CVE-2024-13694 Overview
CVE-2024-13694 is an Insecure Direct Object Reference (IDOR) vulnerability in the WooCommerce Wishlist plugin for WordPress, developed by moreconvert. The flaw affects all versions up to and including 1.8.7. The download_pdf_file() function fails to validate a user-controlled key, allowing unauthenticated attackers to access wishlist data belonging to other users. The vulnerability is classified under [CWE-285] (Improper Authorization) and [CWE-639] (Authorization Bypass Through User-Controlled Key). Attackers can extract sensitive customer wishlist contents by manipulating the request parameter sent to the export endpoint.
Critical Impact
Unauthenticated attackers can extract private wishlist data from any user of an affected WooCommerce store by manipulating the PDF download identifier.
Affected Products
- Moreconvert WooCommerce Wishlist plugin for WordPress
- All versions up to and including 1.8.7
- Sites using the smart-wishlist-for-more-convert plugin slug
Discovery Timeline
- 2025-01-30 - CVE-2024-13694 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13694
Vulnerability Analysis
The vulnerability resides in the download_pdf_file() function of the WooCommerce Wishlist plugin. This function generates and serves PDF exports of user wishlists but accepts a user-supplied identifier without verifying ownership. An attacker can iterate through wishlist identifiers and retrieve PDF exports for arbitrary users.
The relevant code paths are referenced in class-wlfmc-form-handler.php at line 607 and class-wlfmc-wishlist.php at line 529. Both locations handle the wishlist retrieval logic that should enforce authorization but does not.
Because exploitation requires no authentication, no user interaction, and operates over the network, attackers can automate enumeration against vulnerable stores. The impact is limited to confidentiality, with no integrity or availability consequences.
Root Cause
The plugin trusts a client-supplied key parameter to identify which wishlist PDF to generate. The code path does not check whether the requesting session or user owns the referenced wishlist object. This is a textbook IDOR pattern: object access is granted based on a guessable or enumerable identifier rather than an authorization check tied to the authenticated principal.
Attack Vector
An attacker sends crafted HTTP requests to the WordPress site invoking the wishlist PDF export action. By substituting wishlist identifiers in the request, the attacker receives PDF documents containing other users' wishlist contents, which may include product preferences and associated metadata. No credentials, tokens, or session cookies are required. The vulnerability description and external references describe the mechanism. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-13694
Indicators of Compromise
- Repeated unauthenticated HTTP requests to the wishlist PDF download endpoint with sequentially varying identifier parameters.
- Unusual volumes of PDF file responses generated by the smart-wishlist-for-more-convert plugin in web server logs.
- Requests to wishlist export endpoints originating from a single IP across many distinct wishlist IDs.
Detection Strategies
- Inspect WordPress and web server access logs for requests targeting the download_pdf_file action handler exposed by the plugin.
- Alert on enumeration patterns where a client iterates wishlist identifier values within a short window.
- Compare requesting session identity against the wishlist owner recorded in the database to detect unauthorized retrievals.
Monitoring Recommendations
- Forward WordPress access logs and plugin activity to a centralized log analytics platform for behavioral analysis.
- Track the installed version of the smart-wishlist-for-more-convert plugin across WordPress fleets and flag versions at or below 1.8.7.
- Monitor outbound data volume from the wishlist export endpoint and alert on sustained anomalies.
How to Mitigate CVE-2024-13694
Immediate Actions Required
- Update the WooCommerce Wishlist plugin to a version newer than 1.8.7 that includes the fix from changeset 3229758.
- Audit existing wishlist data and customer records for evidence of unauthorized exports during the exposure window.
- Restrict access to the wishlist PDF download endpoint at the web server or WAF layer until the patch is applied.
Patch Information
The vendor addressed the issue in the changeset published at WordPress Changeset 3229758. Site administrators should upgrade to the latest version available on the WordPress Plugin Developer Page. After upgrading, verify the plugin version reported in the WordPress admin dashboard matches the patched release.
Workarounds
- Deactivate the WooCommerce Wishlist plugin until the patched version is installed if immediate upgrade is not feasible.
- Block unauthenticated requests to the wishlist PDF export endpoint using a web application firewall rule that requires a valid WordPress session cookie.
- Apply rate limiting on the wishlist export endpoint to slow enumeration attempts against the user-controlled key parameter.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
