CVE-2025-12040: Wishlist for WooCommerce Auth Bypass Flaw

CVE-2025-12040 Overview

The Wishlist for WooCommerce plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] affecting all versions up to and including 1.1.3. The flaw exists in several functions within class-th-wishlist-frontend.php due to missing validation on a user-controlled key. Unauthenticated attackers can modify other users' wishlists over the network without any user interaction.

Critical Impact
Unauthenticated remote attackers can manipulate wishlist data belonging to arbitrary users, resulting in unauthorized modification of user-owned resources on affected WooCommerce storefronts.

Affected Products

Wishlist for WooCommerce (TH Wishlist) plugin for WordPress
All versions up to and including 1.1.3
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2025-11-25 - CVE-2025-12040 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12040

Vulnerability Analysis

The vulnerability resides in the class-th-wishlist-frontend.php file of the TH Wishlist plugin. Several functions in this class accept a user-controlled identifier that references wishlist objects. The plugin does not verify whether the requesting user owns the referenced wishlist before performing modifications.

Because authorization checks are absent, any request supplying a valid wishlist identifier is treated as legitimate. This maps directly to CWE-639: Authorization Bypass Through User-Controlled Key. The affected functionality is reachable without authentication, expanding the attack surface to any anonymous visitor.

Root Cause

The root cause is missing access control validation on wishlist identifier parameters. The plugin trusts the client-supplied key and dispatches modification actions without confirming ownership or session context. Direct object references are exposed to unauthenticated requests, which violates standard authorization design for multi-user WooCommerce environments.

Attack Vector

An attacker sends crafted HTTP requests to the WordPress site containing wishlist identifiers belonging to other users. The plugin processes these requests through the vulnerable functions in class-th-wishlist-frontend.php and applies the requested changes. No credentials, tokens, or user interaction are required. The attack is fully remote and repeatable against any wishlist identifier the attacker can enumerate or guess. Technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-12040

Indicators of Compromise

Unauthenticated HTTP requests referencing wishlist identifiers with varying or sequential values
Unexpected additions, deletions, or modifications to customer wishlists in the WooCommerce database
Access log entries hitting TH Wishlist plugin endpoints from unauthenticated sessions at high frequency
Customer support reports of wishlist contents changing without user action

Detection Strategies

Audit web server access logs for anonymous requests targeting th-wishlist endpoints, especially with enumerated ID parameters
Review the WordPress database for wishlist modifications originating from sessions without an authenticated user context
Deploy a Web Application Firewall (WAF) rule to flag repeated requests to wishlist handlers with differing identifier values from the same source

Monitoring Recommendations

Enable verbose logging on WordPress admin and plugin activity to capture wishlist state transitions
Correlate WooCommerce database changes with authenticated session data to identify unauthorized modifications
Monitor for anomalous request rates against plugin frontend URLs and alert on patterns consistent with IDOR enumeration

How to Mitigate CVE-2025-12040

Immediate Actions Required

Update the Wishlist for WooCommerce (TH Wishlist) plugin to a version later than 1.1.3 once a patched release is available on the WordPress plugin repository
Disable or uninstall the plugin on production sites until a fixed version is deployed if wishlist functionality is not business-critical
Review recent wishlist modifications and notify affected users if unauthorized changes are identified

Patch Information

Refer to the WordPress Plugin Changeset for the code changes addressing the missing authorization checks. Site administrators should apply the update through the WordPress admin plugin interface as soon as it becomes available.

Workarounds

Restrict access to plugin frontend endpoints using WAF rules that require authenticated session cookies
Apply virtual patching at the reverse proxy layer to reject requests to wishlist handlers lacking valid nonces or session tokens
Temporarily deactivate the TH Wishlist plugin from the WordPress admin dashboard until an official fix is released

bash

# Configuration example: disable the plugin via WP-CLI
wp plugin deactivate th-wishlist
wp plugin status th-wishlist