The Wishlist for WooCommerce plugin is susceptible to an insecure direct object reference flaw caused by missing validation on a user‑controlled key in class‑th‑wishlist‑frontend.php. This weakness, identified as CWE‑639, allows attackers who do not need to be logged in to alter or replace another user’s wishlist entries, thereby breaching data integrity and potentially exposing private preferences.

WordPress sites running the Wishlist for WooCommerce plugin by themehunk, versions up through and including 1.1.3 are affected.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is over the public web interface of the WordPress site, where an unauthenticated attacker can craft requests to the plugin’s modification endpoints by manipulating the key parameter. Given the lack of authentication checks, the exploitation threshold is low, but the impact on data integrity remains significant.