CVE-2025-11532: Wisly WordPress Plugin IDOR Vulnerability

CVE-2025-11532 Overview

CVE-2025-11532 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Wisly plugin for WordPress in all versions up to and including 1.0.0. The flaw stems from missing validation on the wishlist_id user-controlled key. Unauthenticated attackers can manipulate this parameter to remove and add items to wishlists belonging to other users. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated remote attackers can modify wishlist contents of arbitrary users by supplying another user's wishlist_id, breaking integrity of stored wishlist data.

Affected Products

Wisly plugin for WordPress, versions up to and including 1.0.0
WordPress sites with the Wisly plugin installed and activated
Any e-commerce or content site relying on Wisly for user wishlist storage

Discovery Timeline

2025-11-11 - CVE-2025-11532 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11532

Vulnerability Analysis

The Wisly plugin exposes wishlist management functionality that accepts a wishlist_id parameter from client requests. The plugin does not verify that the requesting user owns, or is authorized to modify, the referenced wishlist. This omission allows the identifier to serve as a direct reference to any wishlist stored by the plugin.

Because the endpoint accepts requests without authentication, an attacker does not need a valid WordPress account. Supplying a guessable or enumerated wishlist_id value causes the plugin to operate on the target wishlist as if the request were legitimate. The impact is limited to integrity of wishlist data — item additions and removals — with no direct confidentiality or availability effect noted in the advisory.

Root Cause

The root cause is missing authorization on a user-controlled key. The plugin trusts the wishlist_id value provided in the request and does not tie the operation to an authenticated session or ownership check. This maps directly to CWE-639.

Attack Vector

Exploitation occurs over the network against the vulnerable WordPress site. An unauthenticated attacker sends crafted HTTP requests to the Wisly plugin endpoint, substituting a target's wishlist_id. Successful requests add or remove items from the victim's wishlist. No user interaction is required. Refer to the Wordfence Vulnerability Report for advisory-level technical details.

Detection Methods for CVE-2025-11532

Indicators of Compromise

Unexpected additions or removals of items in user wishlists that users did not initiate
Requests to Wisly plugin endpoints containing sequential or enumerated wishlist_id values from a single source IP
Elevated volumes of unauthenticated POST or GET requests to Wisly action handlers

Detection Strategies

Review WordPress and web server access logs for repeated requests referencing wishlist_id parameters from unauthenticated sessions
Correlate requests to Wisly endpoints against session cookies to identify actions taken without an authenticated user
Monitor for enumeration patterns where wishlist_id values increment across requests from the same client

Monitoring Recommendations

Enable verbose access logging on the WordPress front-end and forward logs to a centralized SIEM for retention and analysis
Alert on anomalous request rates to plugin AJAX or REST endpoints exposed by Wisly
Track wishlist state changes at the database layer to reconcile against expected user activity

How to Mitigate CVE-2025-11532

Immediate Actions Required

Deactivate the Wisly plugin until a patched version is released and validated in a staging environment
Audit existing wishlists for unauthorized modifications and restore known-good state from backups where needed
Restrict access to the affected endpoints at the web application firewall (WAF) layer using rules that require authentication cookies

Patch Information

No fixed version is listed in the advisory at the time of publication. Monitor the Wisly plugin page on WordPress.org and the Wordfence Vulnerability Report for updates and apply the patched release as soon as it becomes available.

Workarounds

Remove or deactivate the Wisly plugin until a vendor fix is published
Block unauthenticated requests to Wisly action endpoints using WAF rules or .htaccess restrictions
Introduce server-side authorization checks via a custom mu-plugin that validates ownership of wishlist_id before Wisly processes the request

bash

# Example WAF rule (ModSecurity) to block unauthenticated wishlist modification
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1105321,\
    msg:'Block unauthenticated Wisly wishlist_id access (CVE-2025-11532)'"
    SecRule ARGS:action "@rx ^wisly_" "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"