CVE-2025-12358: ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "postaddtolist" function as well as an incorrect permissions callback in the "Api/init" function. This makes it possible for unauthenticated attackers to add or remove products from a user's wishlist via a forged request granted they can trick a site's user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12358?
CVE-2025-12358 is classified as a medium severity vulnerability due to potential exploitation via cross-site request forgery.
How do I fix CVE-2025-12358?
To fix CVE-2025-12358, update the ShopEngine Elementor WooCommerce Builder Addon plugin to version 4.8.6 or later, which includes the necessary nonce validation.
Which versions are affected by CVE-2025-12358?
CVE-2025-12358 affects all versions of the ShopEngine Elementor WooCommerce Builder Addon plugin up to and including 4.8.5.
What type of vulnerability is CVE-2025-12358?
CVE-2025-12358 is a Cross-Site Request Forgery (CSRF) vulnerability.
What functions are impacted by CVE-2025-12358?
The 'post_add_to_list' function in the ShopEngine Elementor WooCommerce Builder Addon is impacted by CVE-2025-12358.