CVE-2025-68024: Addonify WooCommerce Wishlist Auth Bypass

CVE-2025-68024 Overview

CVE-2025-68024 is a Missing Authorization vulnerability affecting the Addonify – WooCommerce Wishlist plugin for WordPress. The vulnerability allows attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized modification of plugin settings. This security flaw stems from CWE-862 (Missing Authorization), where critical functions lack proper capability checks before execution.

Critical Impact

Unauthenticated attackers can modify plugin settings due to missing authorization checks, potentially affecting the integrity and availability of WooCommerce wishlist functionality on affected WordPress sites.

Affected Products

• Addonify – WooCommerce Wishlist plugin versions through 2.0.15
• WordPress installations using the vulnerable plugin versions
• WooCommerce stores with Addonify Wishlist integration

Discovery Timeline

• 2026-02-20 - CVE CVE-2025-68024 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2025-68024

Vulnerability Analysis

This vulnerability represents a classic Missing Authorization flaw where the Addonify WooCommerce Wishlist plugin fails to implement proper capability or permission checks before allowing settings modifications. The vulnerability is exploitable over the network without requiring authentication, making it accessible to any remote attacker.

The attack can be conducted with low complexity, requiring no user interaction. While the vulnerability does not expose confidential data, it allows attackers to make unauthorized changes to plugin settings (impacting integrity) and potentially disrupt wishlist functionality (impacting availability).

Root Cause

The root cause is improper access control implementation in the plugin's settings management functionality. The plugin fails to verify that users have the appropriate WordPress capabilities (such as manage_options or similar administrative permissions) before processing settings change requests. This allows any user, including unauthenticated visitors, to invoke settings modification functions that should be restricted to administrators only.

Attack Vector

The vulnerability is exploitable via the network attack vector. Attackers can send crafted HTTP requests to the WordPress installation targeting the vulnerable plugin's AJAX handlers or REST API endpoints responsible for settings management. Since no authentication or authorization checks are performed, these requests are processed regardless of the requester's identity or privilege level.

An attacker could manipulate wishlist display settings, disable features, or modify behavior in ways that disrupt the user experience for legitimate customers. The lack of proper nonce verification and capability checks compounds the issue, making exploitation straightforward for anyone with knowledge of the vulnerable endpoints.

Detection Methods for CVE-2025-68024

Indicators of Compromise

• Unexpected changes to Addonify Wishlist plugin settings in the WordPress admin panel
• Anomalous HTTP requests targeting plugin-specific AJAX actions or REST endpoints
• Unauthorized modification timestamps in the WordPress options table for addonify_wishlist prefixed options
• Unusual POST requests to admin-ajax.php with Addonify Wishlist-related action parameters from unauthenticated sessions

Detection Strategies

• Monitor WordPress options table for unauthorized changes to Addonify Wishlist configuration entries
• Implement web application firewall (WAF) rules to detect and block suspicious requests to admin-ajax.php targeting wishlist-related actions
• Enable comprehensive logging of all AJAX requests in WordPress and review for patterns of settings modification attempts
• Deploy file integrity monitoring to detect any unexpected plugin file changes

Monitoring Recommendations

• Configure WordPress audit logging plugins to track all options changes with user attribution
• Set up alerts for settings modifications occurring outside of administrative sessions
• Review server access logs for unusual POST request patterns targeting plugin endpoints
• Implement rate limiting on AJAX endpoints to slow potential automated exploitation attempts

How to Mitigate CVE-2025-68024

Immediate Actions Required

• Update the Addonify – WooCommerce Wishlist plugin to a version newer than 2.0.15 when a patched version becomes available
• Temporarily disable the Addonify Wishlist plugin if it is not critical to store operations until a patch is applied
• Implement a web application firewall (WAF) with rules to block unauthorized settings modification requests
• Review and document current plugin settings to detect any unauthorized changes

Patch Information

A vulnerability has been identified in Addonify – WooCommerce Wishlist versions through 2.0.15. Site administrators should monitor the WordPress plugin repository and the Patchstack vulnerability database for security updates. Apply the vendor-provided patch immediately upon release.

Workarounds

• Disable the Addonify Wishlist plugin temporarily if wishlist functionality is not essential for business operations
• Implement server-side access restrictions using .htaccess or nginx configuration to limit access to admin-ajax.php from trusted IP addresses only
• Use a WordPress security plugin to add additional authorization layers to AJAX handlers
• Consider temporarily replacing the plugin with an alternative WooCommerce wishlist solution until a patch is available

# Example: Restrict admin-ajax.php access in Apache .htaccess
# Place in WordPress root directory
<Files admin-ajax.php>
    <RequireAll>
        Require all granted
        # Add additional IP restrictions as needed for admin functions
    </RequireAll>
</Files>