CVE-2025-13440
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to a missing capability check on the deleteWishlist() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary wishlists.
Risk Assessment
The risk includes the possibility of unauthorized deletion of users' wishlists, potentially leading to data loss and disruption of store operations.
Recommendation
It is recommended to immediately update the Premmerce Wishlist plugin to the latest version that includes the security fix.
Other vulnerabilities in Premmerce Wishlist for WooCommerce
See all- CVE-2026-97273High
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
- CVE-2026-97268High
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
- CVE-2026-54849Critical
The Premmerce Wishlist plugin for WooCommerce versions up to 1.1.11 contains a vulnerability to unauthenticated SQL injection.
Original NVD description (English source)
The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to a missing capability check on the deleteWishlist() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary wishlists.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS