CVE-2025-58247: TI WooCommerce Wishlist Auth Bypass Flaw

CVE-2025-58247 Overview

CVE-2025-58247 is a Missing Authorization vulnerability [CWE-862] in the TI WooCommerce Wishlist plugin (ti-woocommerce-wishlist) by templateinvaders. The flaw affects all plugin versions up to and including 2.10.0. Attackers can exploit incorrectly configured access control security levels to reach functionality that should require authorization. The issue is network-exploitable, requires no privileges, and needs no user interaction. Successful exploitation results in confidentiality impact on affected WordPress sites running WooCommerce with this plugin.

Critical Impact
Unauthenticated network attackers can access plugin functionality that lacks proper authorization checks, leading to disclosure of wishlist-related data across affected WordPress sites.

Affected Products

templateinvaders TI WooCommerce Wishlist plugin (ti-woocommerce-wishlist)
All versions from initial release through 2.10.0
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2025-09-22 - CVE-2025-58247 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58247

Vulnerability Analysis

The vulnerability is a broken access control issue classified under [CWE-862] Missing Authorization. The plugin exposes functionality without verifying whether the requesting user has permission to invoke it. Attackers reach the affected endpoints over the network without authentication or user interaction.

The scope of impact is limited to confidentiality. Data integrity and availability of the WordPress site remain unaffected. The exploitability metrics indicate a low-complexity attack that any remote actor can attempt against exposed WordPress installations.

According to Patchstack, the vulnerability is categorized as a broken access control issue in the plugin's request handling logic. The EPSS probability for this CVE is 0.263%.

Root Cause

The root cause is missing capability or nonce verification on one or more plugin actions. WordPress plugins typically enforce authorization through current_user_can() checks or check_ajax_referer() calls on AJAX and REST handlers. When these checks are omitted or incorrectly scoped, any visitor can invoke the underlying handler.

In TI WooCommerce Wishlist versions through 2.10.0, at least one such handler executes without validating the caller's privileges, allowing access to wishlist data intended to be restricted.

Attack Vector

The attack path is a direct HTTP request to the vulnerable endpoint. An unauthenticated attacker crafts a request to the exposed plugin action, typically through admin-ajax.php or a REST route registered by the plugin. The server processes the request and returns data that should have required authorization.

Because no authentication or user interaction is required, the vulnerability can be probed and exploited at scale against internet-facing WordPress sites. Refer to the Patchstack advisory for the technical breakdown of the affected handler.

Detection Methods for CVE-2025-58247

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to admin-ajax.php with action parameters referencing tinvwl or ti_woocommerce_wishlist handlers
Requests to plugin REST endpoints under /wp-json/ associated with the wishlist plugin from unauthenticated sessions
Anomalous spikes in traffic to wishlist-related URLs from single source IPs or scanning infrastructure

Detection Strategies

Inspect web server access logs for repeated requests to plugin endpoints without a valid authentication cookie
Deploy WordPress-aware WAF rules that alert on unauthenticated calls to tinvwl AJAX actions
Monitor plugin version inventory across managed WordPress fleets and flag installations at or below 2.10.0

Monitoring Recommendations

Correlate WordPress audit logs with edge traffic to identify unauthenticated data access patterns
Track outbound response sizes on wishlist endpoints, since exfiltration attempts often produce larger responses than normal user interactions
Alert when previously unused plugin actions begin receiving traffic from external IP ranges

How to Mitigate CVE-2025-58247

Immediate Actions Required

Identify all WordPress sites running the ti-woocommerce-wishlist plugin and confirm the installed version
Update the plugin to a version later than 2.10.0 once a fixed release is available from templateinvaders
Restrict access to admin-ajax.php and plugin REST routes at the WAF layer for unauthenticated sources where feasible

Patch Information

Affected versions include TI WooCommerce Wishlist through 2.10.0. Consult the Patchstack advisory and the plugin's official changelog on WordPress.org for the fixed version and release notes. Apply the vendor patch as soon as it becomes available and verify the update across all environments.

Workarounds

Temporarily deactivate the TI WooCommerce Wishlist plugin until a patched version is deployed
Add WAF rules that block unauthenticated requests to plugin AJAX actions and REST routes
Restrict wishlist functionality to authenticated customers through server-side access controls or reverse proxy rules

bash

# Example WAF rule concept blocking unauthenticated tinvwl AJAX calls
# (adapt to your WAF vendor syntax)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1058247,msg:'CVE-2025-58247 tinvwl unauth access'"
  SecRule ARGS:action "@rx ^(tinvwl_|ti_woocommerce_wishlist)" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"