CVE-2026-124763: Critical Vulnerability in Woocommerce Wishlist Plugin for WordPress

Introduction

A critical vulnerability has recently been identified in the Woocommerce Wishlist plugin for WordPress, which may allow unauthenticated users to make significant changes to site options.

What happened?

The vulnerability lies in the lack of authorization and CSRF checks in one of the plugin's unauthenticated AJAX actions. This means that an unauthenticated user can send a request that overwrites any site option using the URL of an uploaded image or an empty value. This can lead to severe consequences, such as changing the site's URL or disabling essential plugins.

How the vulnerability works

The vulnerability allows an attacker, without the need for authentication, to send requests that can modify critical site settings. The absence of proper authorization and CSRF checks makes the system vulnerable to unwanted changes, compromising the integrity and functionality of the site.

What is the real impact?

The impact can be severe, as an attacker can disable essential plugins, change the site's URL, or modify other critical options, leading to service disruptions and data loss. This can affect user trust and the site's reputation.

Which versions are affected?

• Woocommerce Wishlist up to version 1.1.0

How to fix

1. Check the version of the Woocommerce Wishlist plugin installed on your site.
2. Update the plugin to the latest available version, which should address this vulnerability.
3. Consider disabling the plugin until the update is performed if an immediate update is not possible.

Mitigation while you update

While you cannot update, consider the following mitigation measures:

• Temporarily disable the Woocommerce Wishlist plugin.
• Review user permissions and minimize access to critical site functionalities.
• Monitor the site for suspicious activities and maintain regular backups.

Conclusion

It is crucial for site owners using the Woocommerce Wishlist plugin to take immediate action to address this vulnerability. Updating the plugin is the best way to ensure the security and integrity of your site.