A missing authorization flaw in the TI WooCommerce Wishlist plugin (versions up to 2.10.0) enables attackers to bypass access controls and retrieve or alter other users’ wishlists. By exposing personal customer preferences and potentially sensitive data, the vulnerability could be leveraged for targeted phishing, data theft, or other social‑engineering attacks.

WordPress sites that run the templateinvaders TI WooCommerce Wishlist plugin from any version preceding 2.10.1 up through 2.10.0 are affected. The plugin is commonly used to manage wishlists for WooCommerce e‑commerce stores.

The CVSS score of 5.3 indicates a moderate risk, while the EPSS score of less than 1% implies a low likelihood of exploitation and the vulnerability is not currently listed in CISA KEV. Exploitation can be performed remotely by sending crafted HTTP requests to the plugin’s endpoints, taking advantage of the missing authorization checks. As the flaw is accessible through public WordPress interfaces, an attacker with basic technical knowledge can launch the exploit without needing privileged credentials.