WordPress Plugin Vulnerabilities

JVM WooCommerce Wishlist <= 1.2.6 - Insecure Direct Object Reference

Description

Unauthenticated attackers could update the wish-list of arbitrary users

Affects Plugins

Plugin icon
jvm-woocommerce-wishlist
Fixed in 1.2.7

References

URL
https://plugins.trac.wordpress.org/changeset/2138285

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287

Miscellaneous

Verified
No
WPVDB ID
ef09a245-0c42-4373-b91b-c25d54a6e4d9

Timeline

Publicly Published
2019-08-12 (about 6 years ago)
Added
2019-12-02 (about 6 years ago)
Last Updated
2019-12-02 (about 6 years ago)

Other

Published
Title
Published
2025-12-15
Title
WPCOM Member < 1.7.17 - Authentication Bypass via Weak OTP
Published
2026-02-23
Title
WeDesignTech Ultimate Booking Addon <= 1.0.1 - Subscriber+ Authentication Bypass
Published
2024-10-25
Title
Realty Workstation <= 1.0.45 - Authentication Bypass to Account Takeover
Published
2023-05-22
Title
MStore API < 3.9.2 - Authentication Bypass
Published
2026-02-14
Title
Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.72 - Unauthenticated Arbitrary Plugin Installation