CVE-2025-12427 Overview
CVE-2025-12427 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the YITH WooCommerce Wishlist plugin for WordPress in all versions up to and including 4.10.0. The flaw resides in the REST API endpoint and AJAX handler, which fail to validate user-controlled keys. Unauthenticated attackers can enumerate any user's wishlist token ID and rename the victim's wishlist without authorization. The weakness is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).
Critical Impact
Unauthenticated attackers can discover wishlist token IDs belonging to any store user and tamper with wishlist names, enabling defacement, social engineering, mass tampering, and user profiling across multi-user WooCommerce stores.
Affected Products
- YITH WooCommerce Wishlist plugin for WordPress — all versions ≤ 4.10.0
- WordPress sites running WooCommerce with the vulnerable plugin installed
- Multi-user WooCommerce storefronts exposing wishlist REST and AJAX endpoints
Discovery Timeline
- 2025-11-19 - CVE-2025-12427 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12427
Vulnerability Analysis
The YITH WooCommerce Wishlist plugin exposes two attack surfaces that share the same authorization defect: the AJAX handler in class-yith-wcwl-ajax-handler.php and the REST controller in class-yith-wcwl-rest-v1-lists-controller.php. Both accept user-controlled identifiers referencing wishlist objects. Neither surface verifies that the requester owns the referenced wishlist before returning or modifying data.
An unauthenticated attacker can iterate wishlist identifiers through the plugin's endpoints and retrieve token IDs associated with arbitrary store users. Once a token is obtained, the attacker issues a rename request through the same endpoints. The server processes the write operation without confirming that the caller is the wishlist owner, resulting in integrity impact on victim data.
The impact is limited to integrity — confidentiality of underlying customer records and availability of the store remain unaffected. However, the ability to rename wishlists at scale creates a channel for defacement text, phishing lures embedded in wishlist names, and reconnaissance of customer behavior.
Root Cause
The root cause is missing authorization checks on user-controlled keys (CWE-639). The affected code paths at line 265 and line 38 of the AJAX handler, and lines 56 and 97 of the REST v1 lists controller, treat the supplied wishlist identifier as authoritative. The plugin performs no ownership validation and no capability check against the current session before executing the requested action.
Attack Vector
The attack is executed remotely over the network with no authentication and no user interaction. An attacker sends crafted HTTP requests to the plugin's REST route or the WordPress admin-ajax.php endpoint, supplying incrementing or guessed wishlist identifiers. The endpoints return token IDs and accept subsequent rename operations tied to those tokens, allowing full enumeration and tampering of every wishlist on the site. See the Wordfence Vulnerability Report and the WordPress plugin source for the vulnerable code paths.
Detection Methods for CVE-2025-12427
Indicators of Compromise
- Unauthenticated HTTP requests to /wp-json/yith/wishlist/v1/lists/ with sequential or enumerated identifiers.
- Repeated POST requests to admin-ajax.php with wishlist-related action parameters from a single source IP.
- Wishlist records showing unexpected wishlist_name changes without corresponding user login events.
- High-volume 200 responses on wishlist endpoints from IPs with no prior authenticated session.
Detection Strategies
- Review web server access logs for bursts of requests to wishlist REST routes lacking a valid X-WP-Nonce header or authenticated cookie.
- Correlate database changes on the yith_wcwl_lists table with the requesting IP and session identity in application logs.
- Deploy a WordPress-aware Web Application Firewall rule to flag unauthenticated writes to wishlist endpoints.
Monitoring Recommendations
- Alert on anomalous request rates against /wp-json/yith/ routes from single-source IPs.
- Track outbound rename events on wishlist objects and reconcile against authenticated user activity.
- Monitor plugin version inventory across managed WordPress sites and flag installations at or below version 4.10.0.
How to Mitigate CVE-2025-12427
Immediate Actions Required
- Update the YITH WooCommerce Wishlist plugin to a version above 4.10.0 that includes the fix from changeset 3394933.
- Audit the yith_wcwl_lists table for unauthorized wishlist_name modifications since deployment of version 4.10.0 or earlier.
- Rotate any wishlist share tokens exposed during the vulnerable window.
Patch Information
The vendor addressed the vulnerability in the plugin trunk via WordPress plugin changeset 3394933. The patch adds ownership validation to the affected REST and AJAX code paths. Site operators should update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Restrict access to /wp-json/yith/ REST routes at the reverse proxy or WAF layer until the plugin is updated.
- Disable the YITH WooCommerce Wishlist plugin on sites where wishlist functionality is not business-critical.
- Apply a custom rest_authentication_errors filter to require an authenticated session on wishlist endpoints as a temporary control.
# Update the plugin using WP-CLI
wp plugin update yith-woocommerce-wishlist
wp plugin get yith-woocommerce-wishlist --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
