CVE-2026-124647: TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie

Q: Who can exploit this issue?

Unauthenticated users can exploit the vulnerable front-end endpoint; no WordPress account or administrative access is required.

Q: What input is involved in the attack?

The SQL injection is performed through the tinv_wishlistkey cookie, which is incorporated into a SQL statement without adequate sanitization and escaping.

Q: Which installations need remediation?

Sites using TI WooCommerce Wishlist versions earlier than 2.0.7 are affected. Updating the plugin to version 2.0.7 or later addresses the affected version range.

Published Nov 12, 2026

Updated

The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using it in a SQL statement in a front-end endpoint, allowing unauthenticated users to perform SQL injection attacks.

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated users can exploit the vulnerable front-end endpoint; no WordPress account or administrative access is required.

What input is involved in the attack?

The SQL injection is performed through the tinv_wishlistkey cookie, which is incorporated into a SQL statement without adequate sanitization and escaping.

Which installations need remediation?

Sites using TI WooCommerce Wishlist versions earlier than 2.0.7 are affected. Updating the plugin to version 2.0.7 or later addresses the affected version range.

CVE-2026-124647: TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie

Event History

Frequently Asked Questions

Who can exploit this issue?

What input is involved in the attack?

Which installations need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What input is involved in the attack?

Which installations need remediation?