The vulnerability resides in the WPC Smart Wishlist for WooCommerce plugin, allowing an unauthenticated attacker to use exposed AJAX endpoints and a user‑controlled key to empty or add items to any shared wishlist. Because the key is not validated, an attacker who knows or guesses the key can perform arbitrary modifications, violating the integrity of other users’ wishlists. This weakness is a classic instance of CWE‑639: Insufficient Verification of Permissions Before Performing an Action.

Affects the WordPress plugin WPC Smart Wishlist for WooCommerce, versions up to and including 5.0.3, installed on any WordPress site that uses the plugin and permits shared wishlists.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted AJAX requests with a known key, thus achieving unauthenticated wishlist manipulation without requiring user authentication or elevated privileges.