CVE-2025-12777: YITH WooCommerce Wishlist Auth Bypass

CVE-2025-12777 Overview

CVE-2025-12777 is an authorization bypass vulnerability in the YITH WooCommerce Wishlist plugin for WordPress. The flaw affects all versions up to and including 4.10.0. The plugin exposes the REST API endpoint /wp-json/yith/wishlist/v1/lists with permission_callback => '__return_true', which disables authorization checks. A companion AJAX delete_item handler validates only the request nonce and omits object-level authorization. Unauthenticated attackers can chain these weaknesses to disclose wishlist tokens for any user and delete arbitrary wishlist items. The vulnerability is categorized under [CWE-285] Improper Authorization.

Critical Impact
Unauthenticated attackers can enumerate wishlist tokens across all users and delete wishlist items belonging to any account on affected WordPress sites.

Affected Products

YITH WooCommerce Wishlist plugin for WordPress — all versions through 4.10.0
WordPress sites exposing the plugin's REST API endpoints
WooCommerce storefronts using shared wishlist functionality

Discovery Timeline

2025-11-19 - CVE-2025-12777 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12777

Vulnerability Analysis

The YITH WooCommerce Wishlist plugin registers a REST API controller at /wp-json/yith/wishlist/v1/lists for listing user wishlists. The controller declares its route with permission_callback => '__return_true', causing WordPress to accept any caller as authorized. Any unauthenticated HTTP client can query the endpoint and retrieve wishlist metadata, including the secret tokens that identify shared wishlists.

The plugin's AJAX delete_item handler compounds the problem. It calls the WordPress nonce check function but does not verify that the requesting user owns the wishlist referenced in the request. Shared wishlist pages render the delete_item nonce inline in HTML, making the nonce reachable by any visitor who can view a wishlist share URL.

By combining the two flaws, an attacker enumerates wishlist tokens through the REST endpoint, fetches the shared wishlist page to harvest the corresponding nonce, and submits delete_item requests to remove items from any target wishlist. Confidentiality of wishlist contents and integrity of stored items are both affected.

Root Cause

The root cause is missing object-level authorization. The REST route relies on __return_true instead of a permission callback that validates ownership. The AJAX handler treats nonce possession as proof of authorization, conflating CSRF protection with access control.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker issues a GET request to /wp-json/yith/wishlist/v1/lists to enumerate wishlist IDs and tokens, retrieves the public share page to extract the delete_item nonce, and issues authenticated-looking AJAX POST requests to delete items from arbitrary wishlists.

Refer to the Wordfence Vulnerability Report and the YITH REST API Lists Controller source for the vulnerable code paths.

Detection Methods for CVE-2025-12777

Indicators of Compromise

Unauthenticated GET requests to /wp-json/yith/wishlist/v1/lists from external IP addresses
HTTP request bursts that pair REST enumeration with subsequent admin-ajax.php calls invoking delete_item
Web server logs showing anonymous clients accessing shared wishlist URLs immediately before delete_item submissions
Customer reports of missing items from personal or shared wishlists

Detection Strategies

Alert on any unauthenticated access to /wp-json/yith/wishlist/v1/ endpoints, particularly the lists route
Correlate REST API enumeration with AJAX action=delete_item requests originating from the same client within a short window
Baseline the volume of delete_item requests per site and flag sudden spikes or requests without a preceding user session

Monitoring Recommendations

Enable verbose access logging on wp-json and admin-ajax.php and forward logs to your SIEM for correlation
Monitor WordPress plugin inventories to identify sites running YITH WooCommerce Wishlist 4.10.0 or earlier
Track outbound REST responses containing wishlist token fields to detect large-scale enumeration attempts

How to Mitigate CVE-2025-12777

Immediate Actions Required

Update the YITH WooCommerce Wishlist plugin to a version later than 4.10.0 on every affected WordPress site
Audit web server and WordPress logs for unauthenticated access to /wp-json/yith/wishlist/v1/lists since the plugin was installed
Rotate any wishlist share links that may have been enumerated and notify affected customers if wishlist items were deleted
Restrict access to wp-json routes at the edge until patching is confirmed

Patch Information

The vendor released a fix tracked in the YITH WooCommerce Wishlist Changeset. The patch replaces the __return_true permission callback with a proper authorization function and adds object-level ownership checks in the delete_item AJAX handler. Administrators should install the latest release from the WordPress plugin repository.

Workarounds

Deploy a web application firewall rule that blocks unauthenticated requests to /wp-json/yith/wishlist/v1/lists
Disable the YITH WooCommerce Wishlist plugin until the site can be updated if patching is not immediately possible
Remove or restrict shared wishlist pages to authenticated sessions to reduce nonce exposure

bash

# Example WAF rule to block anonymous access to the vulnerable REST route
SecRule REQUEST_URI "@beginsWith /wp-json/yith/wishlist/v1/lists" \
  "id:1012777,phase:1,deny,status:403,log,\
   msg:'CVE-2025-12777 YITH Wishlist REST enumeration blocked',\
   chain"
  SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"