The Premmerce Wishlist for WooCommerce plugin for WordPress is affected by a missing capability check in its deleteWishlist() function. Authenticated users with Subscriber-level access or higher can invoke this function and delete any wishlist at will. This flaw allows attackers to remove user-generated wishlists without permission, leading to data loss and potential disruption of user experience.

Premmerce Wishlist for WooCommerce, a WordPress plugin, is affected in all releases up to and including version 1.1.10. Any site that has this plugin installed and is running one of those versions is vulnerable.

The CVSS v3.1 score of 5.3 indicates a moderate severity, and the EPSS score of < 1% suggests a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. An attacker needs an authenticated WordPress account with Subscriber or higher privileges, and based on the description it is inferred that the attacker can exploit the flaw via the plugin’s delete endpoint, likely through the admin interface or an API call; the attack is local to the site’s host and requires no remote code execution.