CVE-2025-49319: Wishlist for WooCommerce Auth Bypass Flaw

CVE-2025-49319 Overview

CVE-2025-49319 is a missing authorization vulnerability in the WPFactory Wishlist for WooCommerce plugin (wish-list-for-woocommerce) for WordPress. The flaw affects all plugin versions up to and including 3.2.3. It stems from incorrectly configured access control security levels that allow unauthenticated attackers to interact with functionality that should require proper authorization. The vulnerability is classified under [CWE-862] Missing Authorization and can be exploited remotely over the network without user interaction.

Critical Impact
Unauthenticated attackers can exploit broken access control in the Wishlist for WooCommerce plugin to impact integrity and availability of affected WooCommerce stores.

Affected Products

WPFactory Wishlist for WooCommerce plugin versions through 3.2.3
WordPress sites running WooCommerce with the vulnerable plugin installed
E-commerce deployments using wish-list-for-woocommerce for wishlist functionality

Discovery Timeline

2025-07-16 - CVE-2025-49319 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49319

Vulnerability Analysis

The Wishlist for WooCommerce plugin exposes functionality without enforcing proper authorization checks. Attackers can invoke plugin actions that should be restricted to authenticated users or administrators. The issue impacts integrity and availability of WooCommerce store data, though it does not expose confidential information directly. Exploitation requires no privileges, no user interaction, and can be performed over the network. The EPSS score sits at 0.25% with a percentile of 16.2, indicating a low but non-trivial probability of near-term exploitation.

Root Cause

The root cause is the absence of capability checks and nonce validation on plugin endpoints. WordPress plugins are expected to use current_user_can() checks and verify nonces on state-changing operations. In wish-list-for-woocommerce versions up to 3.2.3, one or more handlers omit these checks, allowing unauthorized requests to succeed. This matches the [CWE-862] Missing Authorization pattern.

Attack Vector

An attacker sends crafted HTTP requests to WordPress endpoints exposed by the vulnerable plugin. Because authorization is missing, the plugin processes the request as if it were legitimate. This can allow the attacker to modify wishlist data or trigger plugin functions that affect store integrity and availability. Refer to the Patchstack Vulnerability Advisory for the technical breakdown of the affected endpoints.

Detection Methods for CVE-2025-49319

Indicators of Compromise

Unexpected modifications to wishlist tables or WooCommerce metadata originating from unauthenticated sessions
HTTP POST requests to plugin AJAX or REST endpoints without a valid WordPress authentication cookie
Access log entries showing repeated requests to wish-list-for-woocommerce action handlers from a single IP

Detection Strategies

Monitor WordPress access logs for anonymous requests targeting admin-ajax.php with actions related to the wishlist plugin
Deploy a web application firewall rule that flags plugin endpoints invoked without a session or nonce parameter
Compare installed plugin versions against the fixed release baseline using a plugin inventory tool

Monitoring Recommendations

Alert on plugin file changes and unusual database writes to wishlist-related tables
Track spikes in 200-status responses to plugin endpoints from previously unseen source IPs
Correlate WordPress audit log events with WAF telemetry to identify authorization bypass attempts

How to Mitigate CVE-2025-49319

Immediate Actions Required

Update the WPFactory Wishlist for WooCommerce plugin to a version later than 3.2.3 as soon as the vendor publishes a fix
If no patched version is available, deactivate and remove the plugin until a fix is released
Audit WooCommerce store logs for signs of unauthorized wishlist or product interactions

Patch Information

At the time of publication, the vulnerability affects all versions through 3.2.3. Administrators should consult the Patchstack Vulnerability Advisory and the WPFactory changelog for the fixed release version and apply it across all affected WordPress instances.

Workarounds

Restrict access to admin-ajax.php and plugin REST routes using WAF rules that require authentication headers
Temporarily disable the plugin using the WordPress admin console or wp plugin deactivate wish-list-for-woocommerce
Apply virtual patching via WordPress security plugins that enforce capability checks on the vulnerable endpoints

bash

# Disable the vulnerable plugin via WP-CLI until a patched version is deployed
wp plugin deactivate wish-list-for-woocommerce
wp plugin status wish-list-for-woocommerce