CVE-2025-11518: WPC Smart Wishlist Auth Bypass Flaw

CVE-2025-11518 Overview

CVE-2025-11518 affects the WPC Smart Wishlist for WooCommerce plugin for WordPress in all versions up to and including 5.0.3. The vulnerability is an Insecure Direct Object Reference (IDOR) [CWE-639] present in several wishlist AJAX functions. The plugin fails to validate a user-controlled key exposed when wishlists are shared. Unauthenticated attackers who obtain the shared key can empty and add items to other users' wishlists.

Critical Impact
Unauthenticated attackers with access to a shared wishlist key can modify or empty other users' wishlists, resulting in integrity impact against WooCommerce shoppers using the plugin.

Affected Products

WPC Smart Wishlist for WooCommerce plugin for WordPress
All versions up to and including 5.0.3
WordPress sites running WooCommerce with the vulnerable plugin enabled

Discovery Timeline

2025-10-11 - CVE-2025-11518 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11518

Vulnerability Analysis

The WPC Smart Wishlist for WooCommerce plugin implements a wishlist sharing feature that identifies wishlists using a user-controlled key. Several AJAX handlers accept this key as an input parameter but fail to verify that the requester is authorized to modify the referenced wishlist. This creates an Insecure Direct Object Reference condition. Any actor who learns or guesses the wishlist key can invoke the wishlist AJAX endpoints and mutate wishlist state belonging to another user.

The integrity impact is limited to wishlist contents rather than order data or user accounts. However, since the endpoints are reachable without authentication, exploitation requires only network access to the vulnerable site and knowledge of a target wishlist key.

Root Cause

The root cause is missing authorization validation on the wishlist key parameter in the plugin's AJAX handlers. The plugin treats possession of the key as sufficient proof of ownership, which conflicts with the fact that keys are intentionally shared to distribute wishlists. The plugin does not tie mutation actions to an authenticated session or to a secondary authorization check that verifies the caller owns the wishlist.

Attack Vector

Exploitation proceeds over the network against the WordPress admin-ajax.php endpoint. An attacker sends crafted requests to the vulnerable wishlist AJAX actions supplying a valid wishlist key. Because the endpoints do not require authentication and do not validate ownership, the server processes the requests and modifies the target wishlist. Attackers can enumerate keys that were disclosed through shared URLs, referrer leakage, or public link sharing.

No verified public exploit code is available. For technical details refer to the Wordfence Vulnerability Report and the WordPress Change Log.

Detection Methods for CVE-2025-11518

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php invoking wishlist actions with a key parameter from unexpected source IPs
Sudden wishlist mutations (emptying or item additions) attributed to guest sessions rather than logged-in customers
High request volume enumerating wishlist keys from a single client

Detection Strategies

Inspect web server logs for repeated calls to wishlist AJAX actions with varying key values
Correlate wishlist state changes with the absence of an authenticated user session cookie
Alert on requests to wishlist endpoints originating from IPs with no browsing history on the site

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and forward logs to a centralized SIEM for retention and analysis
Track and rate-limit anonymous requests to wishlist endpoints at the web application firewall
Monitor plugin version inventory across managed WordPress sites and flag any host still running 5.0.3 or earlier

How to Mitigate CVE-2025-11518

Immediate Actions Required

Update the WPC Smart Wishlist for WooCommerce plugin to a version later than 5.0.3 that contains the authorization fix
Audit web server access logs for prior exploitation attempts against wishlist AJAX endpoints
Rotate or invalidate existing shared wishlist keys after patching to eliminate previously leaked keys

Patch Information

Review the vendor changeset referenced in the WordPress Change Log to confirm the fixed version and validate that the authorization check is present in the wishlist AJAX handlers before deploying.

Workarounds

Disable the WPC Smart Wishlist for WooCommerce plugin until it can be updated to a patched release
Deploy WAF rules that block unauthenticated requests to the plugin's wishlist AJAX actions
Disable the wishlist sharing feature if the plugin exposes a configuration option to do so

bash

# Example WAF rule blocking unauthenticated wishlist mutations
# ModSecurity rule to restrict wishlist AJAX actions to authenticated sessions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1011518,msg:'CVE-2025-11518 wishlist IDOR block'"
  SecRule ARGS:action "@rx ^(woosw_|wpc_wishlist_)" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"