The Wisly WordPress plugin is vulnerable to an insecure direct object reference (CWE-639) that permits unauthenticated attackers to remove or add items to other users’ wishlists. The flaw exists because the plugin fails to validate the user‑controlled 'wishlist_id' parameter before modifying wishlist contents. This weakness allows an attacker to alter any wishlist identified by that parameter, potentially changing, deleting, or exposing private wishlist items.

All installations of Softivus Wisly version 1.0.0 or earlier on WordPress sites. The vulnerability applies to any site that has the plugin enabled and does not restrict wishlist editing to authenticated users.

The CVSS score of 5.3 indicates a moderate risk. The EPSS score of less than 1% suggests that widespread exploitation is unlikely at present, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be external, via crafted HTTP requests that include an arbitrary 'wishlist_id'. An attacker only needs to supply a valid or guessed wishlist identifier and can add or delete items regardless of the wishlist owner’s privileges.