CVE-2025-13440
📋 TL;DR
This vulnerability in the Premmerce Wishlist for WooCommerce WordPress plugin allows authenticated users with Subscriber-level access or higher to delete arbitrary wishlists due to missing authorization checks. All WordPress sites using this plugin up to version 1.1.10 are affected. Attackers can disrupt user experience and potentially cause data loss.
💻 Affected Systems
- Premmerce Wishlist for WooCommerce WordPress plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Malicious authenticated users could systematically delete all wishlists on the site, causing significant data loss, disrupting user experience, and potentially impacting e-commerce conversion rates.
Likely Case
Low-privilege authenticated users deleting wishlists belonging to other users, causing minor disruption and potential customer complaints.
If Mitigated
Limited impact if proper user access controls and monitoring are in place, with only isolated incidents of wishlist deletion.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple - just calling the vulnerable function without proper authorization checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.11 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wishlist/trunk/src/Admin/Admin.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Premmerce Wishlist for WooCommerce'. 4. Click 'Update Now' if update available. 5. Alternatively, download version 1.1.11+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDeactivate the vulnerable plugin until patched
wp plugin deactivate premmerce-woocommerce-wishlist
Restrict User Registration
allTemporarily disable new user registration to limit attack surface
wp option update users_can_register 0
🧯 If You Can't Patch
- Implement additional authorization checks via custom code or security plugin
- Monitor and audit wishlist deletion activities in WordPress logs
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins → Installed Plugins. If version is 1.1.10 or lower, you are vulnerable.Check Version:
wp plugin get premmerce-woocommerce-wishlist --field=versionVerify Fix Applied:
After updating, verify plugin version shows 1.1.11 or higher in WordPress admin plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual wishlist deletion patterns
- Multiple wishlist deletions from single user accounts
- Wishlist deletions from low-privilege user roles
Network Indicators:
- POST requests to wishlist deletion endpoints from unexpected user roles
SIEM Query:
source="wordpress" AND (event="wishlist_deleted" OR uri_path="/wp-admin/admin-ajax.php") AND user_role="subscriber"🔗 References
- https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wishlist/tags/1.1.10/src/Admin/Admin.php#L334
- https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wishlist/trunk/src/Admin/Admin.php#L334
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9347900c-61c2-4d63-885e-e971c646b737?source=cve
