The QODE Wishlist for WooCommerce plugin contains an insecure direct object reference (CWE-639). The 'qode_wishlist_for_woocommerce_wishlist_table_item_callback' function accepts a user‑controlled key without validation, enabling an unauthenticated attacker to alter the public view of any wishlist. This could lead to unauthorized modifications of wishlist contents, mislead customers, and potentially impact trust.

WordPress sites that have installed the QODE Wishlist for WooCommerce plugin, specifically any release up to and including version 1.2.7. The plugin is maintained by QODE Interactive.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests the exploitation probability is currently low. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is unauthenticated, an attacker only needs to send a crafted request to the plugin’s AJAX endpoint; no prior authentication is required. The exploit path is therefore simple and could be automated if an attacker chooses to target multiple sites.