The vulnerability is a Missing Authorization issue in the WordPress WPC Smart Wishlist for WooCommerce plugin allowing an attacker to bypass the plugin's access control and access wishlist functionality or data that should be protected. This enforcement weakness is classified as CWE‑862 and can potentially expose confidential wishlist information or alter wishlist state. The brief description indicates a simple access control bypass rather than external code execution or DoS.

The affected vendor is WPClever and the product is the WPC Smart Wishlist for WooCommerce plugin. All releases through version 5.0.8 are impacted, including earlier unversioned or legacy releases. No higher version is specified as affected.

The CVSS v3.1 score is 4.3, indicating a Moderate severity. The EPSS score is below 1%, implying a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Because the issue is a Missing Authorization flaw, the likely attack vector is client‑side interaction with the plugin's endpoints or administrative console, and no elevated privileges are required. An attacker exploiting this flaw could read or modify wishlist data without authentication.