CVE-2025-13157: QODE Wishlist Auth Bypass Vulnerability

CVE-2025-13157 Overview

CVE-2025-13157 is an Insecure Direct Object Reference (IDOR) vulnerability in the QODE Wishlist for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.2.7. The vulnerability resides in the qode_wishlist_for_woocommerce_wishlist_table_item_callback function, which fails to validate a user-controlled key. Unauthenticated attackers can leverage this weakness to update the public view of arbitrary wishlists belonging to other users. The issue is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated remote attackers can modify the public visibility state of arbitrary WooCommerce wishlists, resulting in integrity impact to user-owned data on affected WordPress sites.

Affected Products

QODE Wishlist for WooCommerce plugin for WordPress
All plugin versions up to and including 1.2.7
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2025-11-27 - CVE-2025-13157 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-13157

Vulnerability Analysis

The vulnerability is a classic Insecure Direct Object Reference (IDOR) [CWE-639]. The affected function qode_wishlist_for_woocommerce_wishlist_table_item_callback accepts a user-supplied identifier that references a wishlist record. The function then acts on that record without confirming the requester owns or is authorized to modify it.

Because the endpoint does not require authentication, any remote actor can invoke it. The attacker only needs to supply a valid wishlist identifier to alter the public view attribute of that wishlist. This changes what other visitors see when browsing wishlist content on the affected site.

The impact is limited to integrity of the wishlist visibility state. Confidentiality and availability are not directly affected, and no code execution is possible through this flaw.

Root Cause

The root cause is missing authorization on a user-controlled key. The plugin trusts the wishlist identifier provided in the AJAX request and does not verify session ownership, capability, or nonce state before performing the update. See the vulnerable helper at WordPress Plugin Helper Code and the corrective patch in WordPress Changeset #3402469.

Attack Vector

Exploitation occurs over the network with no authentication and no user interaction. An attacker sends a crafted HTTP request to the plugin's AJAX endpoint, supplying an arbitrary wishlist identifier along with the desired public view value. The plugin processes the request and updates the target wishlist's visibility state. Enumeration of wishlist identifiers is trivial because they are sequential integers. Additional context is available in the Wordfence Vulnerability Report.

No verified public exploit code is available. The vulnerability mechanism is described in prose only, as no sanitized proof-of-concept has been published.

Detection Methods for CVE-2025-13157

Indicators of Compromise

Unexpected changes to the public state of WooCommerce wishlist records in the WordPress database
Unauthenticated admin-ajax.php requests referencing the qode_wishlist_for_woocommerce_wishlist_table_item_callback action
High-volume enumeration of sequential wishlist identifiers from a single source IP
Wishlist visibility changes without a corresponding authenticated session in access logs

Detection Strategies

Inspect WordPress access logs for POST requests to admin-ajax.php invoking the vulnerable callback action from unauthenticated clients.
Compare wishlist visibility state changes against authenticated user session timestamps to detect anomalies.
Alert on requests that iterate through numeric wishlist identifiers in short time windows.

Monitoring Recommendations

Enable request logging on the WooCommerce AJAX endpoint and forward logs to a centralized SIEM.
Track version metadata of installed WordPress plugins and flag hosts running QODE Wishlist for WooCommerce 1.2.7 or earlier.
Monitor database write patterns on wishlist tables to identify bulk unauthorized modifications.

How to Mitigate CVE-2025-13157

Immediate Actions Required

Update the QODE Wishlist for WooCommerce plugin to a version later than 1.2.7 that contains the fix from WordPress Changeset #3402469.
Audit existing wishlists on the site and restore any public view state that appears to have been tampered with.
Restrict access to the plugin's AJAX endpoint at the web application firewall (WAF) layer until patching is complete.

Patch Information

The vendor addressed the issue in the plugin repository via changeset 3402469. The fix adds validation on the user-controlled key inside qode_wishlist_for_woocommerce_wishlist_table_item_callback so that only authorized owners can modify a wishlist's public view state. Site administrators should upgrade through the WordPress plugin manager or by pulling the latest trunk release.

Workarounds

Deactivate the QODE Wishlist for WooCommerce plugin until the patched version is installed.
Deploy a WAF rule that blocks unauthenticated requests targeting the vulnerable AJAX action name.
Restrict access to admin-ajax.php from unauthenticated sources where business requirements allow.

bash

# Example WAF rule blocking unauthenticated calls to the vulnerable AJAX action
# ModSecurity syntax
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1013157,msg:'Block CVE-2025-13157 wishlist IDOR'"
  SecRule ARGS:action "@streq qode_wishlist_for_woocommerce_wishlist_table_item_callback" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"