The TI WooCommerce Wishlist plugin fails to enforce the same owner‑only access control on its REST API that it applies on the front‑end. Unauthenticated users can use the API to read the metadata and item contents of private wishlists. This leads to the disclosure of private customer wishlist data and exposes potentially sensitive product preferences. The weakness is an improper access control issue (CWE‑284).

The vulnerability affects all installations of the TI WooCommerce Wishlist WordPress plugin with a version earlier than 2.13.0. There are no further version restrictions listed; any deployment using the legacy plugin may be exposed. Users should verify their installed version and determine if it is below the patched release.

The CVSS base score of 5.3 indicates a moderate risk. The EPSS indicates an exploitation probability of less than 1 %, suggesting that attacks are currently rare. The plugin is not listed in the CISA KEV catalog, so no known active exploitation has been reported. The likely attack path involves calling the REST API with a share_key parameter; however, this key is not explicitly mentioned in the description and is inferred from the title and typical API usage.