CVE-2025-13157: QODE Wishlist for WooCommerce <= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update
The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.7 via the 'qodewishlistforwoocommercewishlisttableitemcallback' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to update the public view of arbitrary wishlists.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13157?
CVE-2025-13157 is considered a medium risk due to its potential for unauthorized access to user data.
How do I fix CVE-2025-13157?
To fix CVE-2025-13157, update the QODE Wishlist for WooCommerce plugin to version 1.2.8 or later.
What versions of QODE Wishlist for WooCommerce are affected by CVE-2025-13157?
CVE-2025-13157 affects the QODE Wishlist for WooCommerce plugin in all versions up to and including 1.2.7.
What type of vulnerability is CVE-2025-13157?
CVE-2025-13157 is categorized as an Insecure Direct Object Reference vulnerability.
Who is the vendor for CVE-2025-13157?
The vendor for CVE-2025-13157 is QODE, which develops the Wishlist for WooCommerce plugin.