medium5.3
CVE-2026-15261
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end…
Impact
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.
Affected products
| Product | Affected versions |
|---|---|
| TI WooCommerce Wishlist WordPress Plugin | before 2.13.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.