CVE-2025-11742

MediumCVSS 4.3

Published: 18/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wishlist_quickview' AJAX action in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's wishlist data and information.

Risk Assessment

Breach of confidentiality of other users' data, including their preferences and wishlists. This may lead to leakage of personal or commercial data.

Recommendation

Update the WPC Smart Wishlist plugin to a version newer than 5.0.4 that fixes the missing capability check. Consider restricting access to the AJAX action to authorized roles only.

Other vulnerabilities in WPC Smart Wishlist for WooCommerce

CVE-2025-11518Medium
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via several wishlist AJAX functions due to missing validation on a user controlled key that is exposed when wishlists are shared. This makes it possible for unauthenticated attackers to empty and add to other user's wishlists, if they have access to the key.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS