CVE-2024-13694: WooCommerce Wishlist <= 1.8.7 - Unauthenticated Wishlist Disclosure via download_pdf_file Function
First published: Thu Jan 30 2025(Updated: )
The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.7 via the download_pdf_file() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to extract data from wishlists that they should not have access to.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WooCommerce Wishlist | <=1.8.7 | |
| MoreConvert MC Woocommerce Wishlist | <1.8.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/59fe7630-ab94-419f-aca5-39b74d86ae4e?source=cve
- https://wordpress.org/plugins/smart-wishlist-for-more-convert/#developers
- https://plugins.trac.wordpress.org/browser/smart-wishlist-for-more-convert/trunk/includes/class-wlfmc-form-handler.php#L607
- https://plugins.trac.wordpress.org/browser/smart-wishlist-for-more-convert/trunk/includes/class-wlfmc-wishlist.php#L529
- https://plugins.trac.wordpress.org/changeset/3229758/
Frequently Asked Questions
What is the severity of CVE-2024-13694?
CVE-2024-13694 is classified as a high severity vulnerability due to its potential for exploitation via insecure direct object reference.
How does CVE-2024-13694 affect WooCommerce Wishlist?
CVE-2024-13694 affects WooCommerce Wishlist versions up to and including 1.8.7 by allowing unauthorized access to resources.
How do I fix CVE-2024-13694?
To fix CVE-2024-13694, update the WooCommerce Wishlist plugin to the latest version that addresses this vulnerability.
What functions are involved in CVE-2024-13694?
The vulnerability is associated with the download_pdf_file() function, which lacks proper validation.
Can CVE-2024-13694 be exploited remotely?
Yes, CVE-2024-13694 can be exploited remotely due to insufficient access controls in the plugin.
- agent/severity
- agent/references
- agent/title
- agent/author
- agent/source
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/remedy
- agent/weakness
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/event
- vendor/woocommerce
- canonical/woocommerce wishlist
- vendor/moreconvert
- canonical/moreconvert mc woocommerce wishlist