The WooCommerce Wishlist plugin contains an insecure direct object reference in the ‘awwlm_remove_added_wishlist_page’ AJAX action. Because the request is not validated against the requester's identity, an authenticated user with a Subscriber role or higher can delete any wishlist item belonging to another user. This allows a malicious actor to erase selected products from other customers’ wishlists, damaging data integrity and potentially undermining customer trust in the e‑commerce platform, but it does not provide code execution or broader system compromise.

Any WordPress site running the acowebs Wishlist and Save for later for WooCommerce plugin with a version of 1.1.22 or earlier, regardless of the WordPress or WooCommerce version, is affected.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% shows a very low current exploitation probability, and the vulnerability is not listed in CISA KEV. Exploitation requires a valid account; the attacker needs only Subscriber-level access, so the attack vector is user‑based. Although the impact is limited to data tampering, the ease of operation and lack of authentication checks raise the practical risk for sites with many active users.