CVE-2024-13774

MEDIUM

Wishlist for WooCommerce <= 3.1.7 - Cross-Site Request Forgery via 'save_to_multiple_wishlist'

Title source: llm

Description

The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.7. This is due to missing or incorrect nonce validation on the 'save_to_multiple_wishlist' function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

References (5)

Core 5

Core References

https://plugins.trac.wordpress.org/browser/wish-list-for-woocommerce/tags/3.1.8/includes/free/class-alg-wc-wish-list-ajax.php#L337

https://plugins.trac.wordpress.org/browser/wish-list-for-woocommerce/tags/3.1.8/includes/free/class-alg-wc-wish-list-ajax.php#L789

Product

https://plugins.trac.wordpress.org/browser/wish-list-for-woocommerce/tags/3.1.7/includes/free/class-alg-wc-wish-list-ajax.php#L337

Product

https://plugins.trac.wordpress.org/browser/wish-list-for-woocommerce/tags/3.1.7/includes/free/class-alg-wc-wish-list-ajax.php#L789

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/c11456bb-dde3-4ab8-b00b-a6cdcc68a760?source=cve

Scores

CVSS v3 6.1

EPSS 0.0017

EPSS Percentile 6.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-352

Status published

Products (2)

wpcodefactory/Wishlist for WooCommerce: Multi Wishlists Per Customer < 3.1.7

wpfactory/wishlist_for_woocommerce < 3.1.8

Published Mar 08, 2025

Tracked Since Feb 18, 2026