CVE-2025-12777: YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion

Vulnerability summary

CVE-2025-12777 is a medium (CVSS 5.3) Improper Authorization vulnerability in wordpress yith-woocommerce-wishlist. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25.1% of scored vulnerabilities. Fixed in 4.10.1.

Timeline

1. 19-11-2025
   PublishedVulnerability first disclosed.
2. 08-04-2026
   Last modifiedVulnerability information updated.

Description

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This is due to the plugin not properly verifying that a user is authorized to perform actions on the REST API /wp-json/yith/wishlist/v1/lists endpoint (which uses permission_callback => '__return_true') and the AJAX delete_item handler (which only checks nonce validity without verifying object-level authorization). This makes it possible for unauthenticated attackers to disclose wishlist tokens for any user and subsequently delete wishlist items by chaining the REST API authorization bypass with the exposed delete_item nonce on shared wishlist pages and the AJAX handler's missing object-level authorization check.

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.