{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-67929", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-15T09:59:55.700Z", "datePublished": "2025-12-16T08:12:57.185Z", "dateUpdated": "2026-04-28T16:14:23.737Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "ti-woocommerce-wishlist", "product": "TI WooCommerce Wishlist", "vendor": "templateinvaders", "versions": [{"changes": [{"at": "2.11.0", "status": "unaffected"}], "lessThanOrEqual": "2.10.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Bao - BlueRock | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:23:52.066Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.</p>"}], "value": "Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:23.737Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/ti-woocommerce-wishlist/vulnerability/wordpress-ti-woocommerce-wishlist-plugin-2-10-0-broken-access-control-vulnerability-2?_s_id=cve"}], "title": "WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T18:04:41.769221Z", "id": "CVE-2025-67929", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T18:04:44.530Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-67929", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T18:04:41.769221Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T15:00:39.500Z"}}], "cna": {"title": "WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Bao - BlueRock | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "templateinvaders", "product": "TI WooCommerce Wishlist", "versions": [{"status": "affected", "changes": [{"at": "2.11.0", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "2.10.0"}], "packageName": "ti-woocommerce-wishlist", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:23:52.066Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/ti-woocommerce-wishlist/vulnerability/wordpress-ti-woocommerce-wishlist-plugin-2-10-0-broken-access-control-vulnerability-2?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:13:54.787Z"}}}, "cveMetadata": {"cveId": "CVE-2025-67929", "state": "PUBLISHED", "dateUpdated": "2026-04-27T18:04:44.530Z", "dateReserved": "2025-12-15T09:59:55.700Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2025-12-16T08:12:57.185Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0."}], "id": "CVE-2025-67929", "lastModified": "2026-04-27T18:16:50.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2025-12-16T09:15:59.320", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/ti-woocommerce-wishlist/vulnerability/wordpress-ti-woocommerce-wishlist-plugin-2-10-0-broken-access-control-vulnerability-2?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T10:15:44.170992+00:00", "value": {"mitigation_remediation": ["Update the TI WooCommerce Wishlist plugin to the latest available version (\u2265\u202f2.10.1).", "Remove or correct any custom role or capability assignments that inadvertently grant users full wishlist control.", "Implement monitoring of the plugin endpoints for suspicious activity and consider temporary disabling until the patch is applied."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Access to Wishlist Data"}, "threat_synthesis": {"affected_systems": "The vulnerability affects WordPress sites that use the TI WooCommerce Wishlist plugin from the earliest release up through version\u00a02.10.0. All installations running any version of the plugin in that range are potentially impacted, regardless of custom configuration. The affected product is developed by templateinvaders.", "description_and_impact": "Missing authorization (CWE-862) in the TI WooCommerce Wishlist plugin allows attackers to exploit incorrectly configured access control settings, potentially enabling unauthorized access to or manipulation of users\u2019 wishlists. The weakness can be used to view, edit, or delete wishlist items belonging to other users, exposing personal shopping preferences and possibly sensitive data.", "risk_and_exploitability": "With a current CVSS score of 5.3, the issue is considered moderate and introduces a potential data privacy breach. The EPSS score of less than\u202f1\u202f% indicates that exploitation in the wild is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is likely remote via the WordPress web interface, meaning any attacker who can access the site could craft requests to reach the privileged plugin endpoints. Defensive measures should therefore focus on disabling or patching the plugin and ensuring proper access constraints."}}}}, "created": "2025-12-16T17:08:59.580080+00:00", "updated": "2026-04-28T10:30:29.006503+00:00", "vendors": ["templateinvaders", "templateinvaders$PRODUCT$ti_woocommerce_wishlist", "wordpress", "wordpress$PRODUCT$wordpress"]}