WordPress Addonify – WooCommerce Wishlist plugin suffers a missing authorization flaw that allows an attacker to modify plugin settings without proper privilege verification. The vulnerability stems from an incorrectly implemented access control check, enabling unauthorized configuration changes. Altering these settings can disrupt normal wishlist functionality and potentially expose the site to further risks if the plugin’s configuration is used to control other features, but no additional exploitation beyond configuration changes is indicated in the CVE description.

All installations of Addonify – WooCommerce Wishlist for WordPress that are at version 2.0.15 or earlier are susceptible. The flaw is confined to the plugin’s settings interface and does not affect WordPress core or unrelated plugins.

The CVSS score of 6.5 signals moderate severity. The EPSS score is below 1%, implying a low likelihood of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Likely exploitation occurs via the plugin’s settings page accessed in a web browser; it is inferred that the attacker may need any authenticated WordPress user whose session the plugin incorrectly trusts, but the CVE data does not explicitly state the required authentication level.