The vulnerability is a missing authorization flaw in the Saeed MC Woocommerce Wishlist smart‑wishlist‑for‑more‑convert plugin. It allows an attacker who can reach the plugin’s endpoints to access or manipulate wishlist data without proper authentication or authorization, effectively bypassing intended access controls. This can enable an attacker to view, modify, or delete wishlist entries belonging to other users, leading to privacy violations and potential data tampering.

WordPress sites using the MC Woocommerce Wishlist plugin version 2.0.3 or earlier are affected. The vulnerability is present in all releases from the initial version up through 2.0.3. Users of the plugin should confirm they are running a version older than 2.0.4.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available to gauge current exploitation probability. The vulnerability is not listed in CISA KEV. Attackers can exploit it via direct HTTP requests to the plugin's endpoints, assuming they can reach the WordPress installation. The risk increases if the site allows high‑privileged users or guest users to interact with wishlist functions, as the missing access checks may expose sensitive data.