CVE-2025-58247

MediumCVSS 5.3

Published: 22/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

The TI WooCommerce Wishlist plugin for WordPress (versions up to and including 2.10.0) contains a Missing Authorization vulnerability allowing exploitation of incorrectly configured access control levels. An unauthorized user can perform operations reserved for higher roles.

Risk Assessment

An attacker can modify wishlists, customer data, or other resources managed by the plugin without proper permissions. This may compromise privacy and data integrity of the store.

Recommendation

Update the TI WooCommerce Wishlist plugin to a version newer than 2.10.0. Verify permission configuration and restrict access to administrative functions.

Other vulnerabilities in TI WooCommerce Wishlist

CVE-2025-9207Medium
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.10.0. This is due to the plugin accepting hidden fields and not limiting the values or data that can be input and is later output. This makes it possible for unauthenticated attackers to inject arbitrary HTML into wishlist items.

Original NVD description (English source)

Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS