CVE-2024-13694

HIGH

Moreconvert Woocommerce Wishlist < 1.8.8 - Improper Authorization

Title source: rule
STIX 2.1

Description

The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.7 via the download_pdf_file() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to extract data from wishlists that they should not have access to.

References (5)

Core 5

Scores

CVSS v3 7.5
EPSS 0.0005
EPSS Percentile 16.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-639 CWE-285
Status published
Products (2)
moreconvert/MoreConvert Wishlist for WooCommerce < 1.8.7
moreconvert/woocommerce_wishlist < 1.8.8
Published Jan 30, 2025
Tracked Since Feb 18, 2026