CVE-2026-32407: WPC Smart Wishlist Auth Bypass Flaw

CVE-2026-32407 Overview

CVE-2026-32407 is a missing authorization vulnerability in the WPClever WPC Smart Wishlist for WooCommerce plugin. The flaw affects all versions up to and including 5.0.8. The plugin fails to enforce proper access control checks, allowing authenticated users with low privileges to interact with functionality intended for higher-privileged roles. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact

Authenticated attackers with low-level privileges can exploit incorrectly configured access control to perform unauthorized actions, leading to limited integrity impact on affected WooCommerce stores.

Affected Products

• WPClever WPC Smart Wishlist for WooCommerce (plugin slug: woo-smart-wishlist)
• All versions from n/a through 5.0.8
• WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

• 2026-03-13 - CVE-2026-32407 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-32407

Vulnerability Analysis

The vulnerability is a broken access control issue in the WPC Smart Wishlist for WooCommerce plugin. The plugin exposes functionality without verifying that the requesting user has the appropriate capability or role. An attacker authenticated as a low-privilege user, such as a subscriber or customer, can invoke restricted operations through network requests.

The attack vector is network-based, requires low attack complexity, and demands only low privileges with no user interaction. The impact is limited to integrity, with no direct effect on confidentiality or availability. This positions the flaw as a horizontal or vertical privilege boundary issue rather than a full account takeover.

Missing authorization vulnerabilities in WordPress plugins typically arise when developers omit current_user_can() checks or rely solely on nonce validation. Nonces confirm request origin but do not enforce authorization. The plugin must explicitly verify capabilities before executing privileged actions.

Root Cause

The root cause is incorrectly configured access control security levels within the plugin's request handlers. Functions exposed via AJAX endpoints or REST routes lack capability checks that gate sensitive operations behind appropriate user roles.

Attack Vector

An authenticated attacker sends crafted HTTP requests to vulnerable plugin endpoints. Because the plugin does not validate the user's authorization level, the action proceeds despite the user lacking the intended permission. Exploitation requires only valid authenticated session credentials on the target WordPress site.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-32407

Indicators of Compromise

• Unexpected modifications to wishlist data tied to user accounts that should not have such access
• HTTP POST requests to admin-ajax.php or plugin REST routes from low-privilege authenticated sessions
• Log entries showing wishlist-related actions executed by user roles such as subscriber or customer outside normal patterns

Detection Strategies

• Audit WordPress access logs for requests targeting woo-smart-wishlist endpoints originating from low-privilege accounts
• Review WooCommerce and plugin database tables for state changes that cannot be attributed to administrative or owner actions
• Deploy a Web Application Firewall (WAF) rule to flag anomalous parameter usage against wishlist plugin endpoints

Monitoring Recommendations

• Enable verbose logging on WordPress AJAX and REST API calls handled by the plugin
• Correlate authenticated session activity against expected user role behavior
• Alert on bursts of requests to plugin endpoints from a single authenticated session

How to Mitigate CVE-2026-32407

Immediate Actions Required

• Identify all WordPress installations running WPC Smart Wishlist for WooCommerce version 5.0.8 or earlier
• Apply the vendor patch as soon as a fixed version is released by WPClever
• Restrict authenticated user registration on sites where customer or subscriber accounts are not required

Patch Information

At the time of publication, refer to the Patchstack advisory for the latest patch status. Site operators should upgrade to a version released after 5.0.8 once available from WPClever.

Workarounds

• Temporarily disable the WPC Smart Wishlist for WooCommerce plugin until a patched version is installed
• Apply virtual patching at the WAF layer to block unauthenticated and low-privilege access to plugin endpoints
• Reduce the attack surface by limiting account creation to trusted users only

# Configuration example: disable the plugin via WP-CLI
wp plugin deactivate woo-smart-wishlist

# Verify plugin status
wp plugin status woo-smart-wishlist