Technical impact
The vulnerability lies in the WPC Smart Wishlist for WooCommerce plugin where the AJAX endpoint 'wishlist_quickview' lacks the necessary capability check for the 'wishlist_quickview' action. This omission allows an authenticated WordPress user who holds at least a Subscriber role to request and view another user's wishlist data, including item details and personal information that should remain private. The weakness is defined as a missing authorization (CWE-862).
Affected Systems
The affected product is WPC Smart Wishlist for WooCommerce (wpclever) in all releases up to and including version 5.0.4. Users running any version 5.0.4 or older are vulnerable regardless of how many sites or users they host.
Risk and Exploitability
The CVSS score of 4.3 categorizes the vulnerability as Low. The EPSS score of less than 1% suggests that exploitation is unlikely but not impossible. The advisory notes that the issue is not listed in CISA's KEV catalog. The attack requires an authenticated user with Subscriber role or higher, who can then send AJAX requests to the 'wishlist_quickview' endpoint to retrieve another user’s wishlist information.
