Skip to content
Fencer Intel
no cvss —

CVE-2026-124648 json

TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key

published 3h ago modified 3h ago also EUVD-2026-124282

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists.

Patch / fix

  • Unknown TI WooCommerce Wishlist 2.13.0

Is CVE-2026-124648 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploits and checks

  • wpscan.com https://wpscan.com/vulnerability/528218ee-f437-4028-aae0-022435cbb66e/ referenced PoC, tagged "exploit" by a source, unverified

Affected products

  • Unknown TI WooCommerce Wishlist

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.