CVE-2026-15261: TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_key
Published Oct 21, 2026
·Updated
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.
Affected Software
1 affected component
TemplateInvaders TI WooCommerce Wishlist<2.13.0
Event History
Oct 21, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any unauthenticated user who can make requests to the affected plugin's REST API may be able to read private wishlist metadata and item contents.
2
What information could be exposed?
The issue can disclose the metadata and item contents of private wishlists.
3
Are front-end access controls sufficient to prevent disclosure?
No. The plugin applies owner-only access control on the front end, but affected versions do not enforce the same restriction on the REST API.
4
Which versions are affected?
TI WooCommerce Wishlist versions before 2.13.0 are affected.