CVE-2025-12087: WordPress Wishlist Plugin Auth Bypass Flaw

CVE-2025-12087 Overview

CVE-2025-12087 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the Wishlist and Save for later for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.1.22. The vulnerability resides in the awwlm_remove_added_wishlist_page AJAX action, which fails to validate a user-controlled key before performing wishlist item deletion. Authenticated attackers with Subscriber-level access or above can delete wishlist items belonging to other users.

Critical Impact
Any authenticated user can manipulate or delete wishlist items owned by other customers, resulting in integrity loss for WooCommerce shoppers on affected sites.

Affected Products

WordPress Wishlist and Save for later for WooCommerce plugin versions 1.0 through 1.1.22
WooCommerce-enabled WordPress sites using the aco-wishlist-for-woocommerce plugin
All sites permitting Subscriber-level (or higher) user registration with the plugin installed

Discovery Timeline

2025-11-12 - CVE-2025-12087 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12087

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference in the plugin's wishlist management workflow. The awwlm_remove_added_wishlist_page AJAX handler accepts a user-supplied identifier to determine which wishlist entry to remove. The handler does not verify that the requesting user owns the wishlist item associated with the submitted key.

Because authorization is not enforced at the object level, an authenticated attacker can substitute another user's wishlist identifier and trigger deletion. The attack requires only a valid session with Subscriber-level privileges, which many WooCommerce storefronts grant to any customer account. Exploitation results in unauthorized modification of another user's data but does not disclose confidential information or affect site availability.

Root Cause

The root cause is missing ownership validation on the user-controlled key passed to the awwlm_remove_added_wishlist_page AJAX action. The plugin authenticates the request but does not correlate the target wishlist item with the current user's identity before performing the delete operation. This matches the CWE-639 pattern: Authorization Bypass Through User-Controlled Key.

Attack Vector

An authenticated attacker sends a crafted admin-ajax.php POST request invoking the awwlm_remove_added_wishlist_page action with a target identifier belonging to another user. The server processes the request under the attacker's session and removes the referenced wishlist entry. No user interaction from the victim is required.

Refer to the Wordfence Vulnerability Report for additional context and the WordPress Plugin Change Log for patch history.

Detection Methods for CVE-2025-12087

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing the action=awwlm_remove_added_wishlist_page parameter originating from low-privilege user sessions
Customer support tickets or user reports describing wishlist items disappearing without user action
Unexpected deletions in the plugin's wishlist database table with mismatched user ID and session context

Detection Strategies

Correlate WordPress access logs with plugin database changes to identify wishlist deletions initiated by users who do not own the target item
Enable WordPress audit logging (via a plugin such as WP Activity Log) to record AJAX actions and record the acting user_id for each awwlm_remove_added_wishlist_page call
Baseline the normal rate of wishlist deletions per account and alert on Subscriber accounts issuing high-volume deletion requests

Monitoring Recommendations

Monitor web server logs for repeated admin-ajax.php invocations of awwlm_remove_added_wishlist_page from a single session or IP address
Alert on POST bodies where the referenced wishlist ID does not match records associated with the authenticated user
Track newly registered Subscriber accounts that immediately begin issuing AJAX requests to wishlist endpoints

How to Mitigate CVE-2025-12087

Immediate Actions Required

Update the Wishlist and Save for later for WooCommerce plugin to a version later than 1.1.22 as soon as a patched release is published
Audit existing user accounts and remove untrusted Subscriber-level accounts that show anomalous AJAX activity
Review wishlist database records for unexplained deletions and restore from backup where necessary

Patch Information

At the time of publication, review the WordPress Plugin Change Log for the vendor's remediation status. Administrators should apply the first available release above 1.1.22 that references the awwlm_remove_added_wishlist_page handler. Verify the fix by confirming that the AJAX handler validates the current user against the wishlist item owner before deletion.

Workarounds

Disable the Wishlist and Save for later for WooCommerce plugin until a patched version is installed
Restrict new user registration or require administrator approval for new accounts to reduce the attacker pool
Deploy a Web Application Firewall (WAF) rule blocking unauthenticated or cross-user invocations of the awwlm_remove_added_wishlist_page action

bash

# Example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate aco-wishlist-for-woocommerce
wp plugin status aco-wishlist-for-woocommerce