CVE-2025-49319

Executive Summary

CVE-2025-49319 is a Missing Authorization vulnerability in the WPFactory Wishlist for WooCommerce plugin (slug: wish-list-for-woocommerce). This flaw allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to wishlist data or manipulation of wishlist entries. The vulnerability affects all versions up to and including 3.2.3. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available.

This vulnerability is specific to the WordPress ecosystem, affecting sites running the WooCommerce plugin with the Wishlist extension. Attackers can leverage missing authorization checks in AJAX endpoints or REST API routes to read, modify, or delete wishlist data without proper authentication.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is exploitable without authentication, but the impact is limited to low confidentiality and integrity loss. Attackers can view or modify wishlist data but cannot directly compromise the entire site.

Deep Dive & Mechanics

The vulnerability resides in the Wishlist for WooCommerce plugin's AJAX handlers and REST API endpoints. The plugin fails to properly verify user capabilities or nonce tokens before processing requests to create, read, update, or delete wishlist items.

Root Cause: The plugin uses wp_ajax_ and wp_ajax_nopriv_ hooks for some actions, but the authorization checks are either missing or incorrectly implemented. For example, the wishlist_add_item action may not verify that the current user owns the wishlist or has the required capability.

Attack Vector: An unauthenticated attacker can send crafted HTTP requests to the WordPress site, targeting endpoints like:

• /wp-admin/admin-ajax.php?action=wishlist_add_item
• /wp-json/wishlist/v1/items

Impact: Successful exploitation allows:

• Viewing private wishlists of other users.
• Adding or removing items from any wishlist.
• Modifying wishlist metadata (e.g., name, privacy settings).

Prerequisites: The attacker only needs network access to the vulnerable WordPress site. No authentication or special privileges are required.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common authorization fixes.

Vulnerable Code (version <= 3.2.3):

add_action('wp_ajax_wishlist_add_item', 'wishlist_add_item_callback');
add_action('wp_ajax_nopriv_wishlist_add_item', 'wishlist_add_item_callback');

function wishlist_add_item_callback() {
    $item_id = intval($_POST['item_id']);
    $wishlist_id = intval($_POST['wishlist_id']);
    // Missing authorization check
    $result = add_item_to_wishlist($wishlist_id, $item_id);
    wp_send_json($result);
}

Patched Code (hypothetical):

add_action('wp_ajax_wishlist_add_item', 'wishlist_add_item_callback');
// Remove nopriv hook to require authentication
// add_action('wp_ajax_nopriv_wishlist_add_item', 'wishlist_add_item_callback');

function wishlist_add_item_callback() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'wishlist_nonce')) {
        wp_die('Security check failed');
    }
    // Check user capability
    if (!current_user_can('edit_others_posts')) {
        wp_die('Unauthorized');
    }
    $item_id = intval($_POST['item_id']);
    $wishlist_id = intval($_POST['wishlist_id']);
    // Verify wishlist ownership
    $wishlist = get_wishlist($wishlist_id);
    if ($wishlist->user_id !== get_current_user_id()) {
        wp_die('You do not own this wishlist');
    }
    $result = add_item_to_wishlist($wishlist_id, $item_id);
    wp_send_json($result);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Environment:

• WordPress 6.7 with WooCommerce 9.4
• Wishlist for WooCommerce 3.2.3
• Attacker machine with curl or Burp Suite

Exploitation Steps:

1. Identify vulnerable endpoints:

   curl -s "http://target/wp-admin/admin-ajax.php?action=wishlist_get_items&wishlist_id=1"
   

2. Add item to another user's wishlist:

   curl -X POST "http://target/wp-admin/admin-ajax.php" \
     -d "action=wishlist_add_item&wishlist_id=1&item_id=123"
   

3. Delete item from wishlist:

   curl -X POST "http://target/wp-admin/admin-ajax.php" \
     -d "action=wishlist_remove_item&wishlist_id=1&item_id=123"
   

Expected Output: The server returns JSON with the wishlist data or success message without requiring authentication.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual AJAX requests to admin-ajax.php with action=wishlist_* parameters from unauthenticated users.
2. Check for rapid succession of wishlist operations (add/remove) from a single IP.
3. Review web server logs for requests to /wp-json/wishlist/v1/* without valid JWT or nonce tokens.

Honeypot Setup:

• Create a fake wishlist with a unique item ID.
• Monitor for unauthorized access attempts to this wishlist.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /wp-admin/admin-ajax.php with action=wishlist_* parameters from unauthenticated sources.
• Requests to /wp-json/wishlist/v1/* without X-WP-Nonce header.
• Unusual patterns of wishlist item additions/deletions in a short time frame.

File IOCs:

• Modified plugin files in /wp-content/plugins/wish-list-for-woocommerce/ (check file integrity via checksums).
• Suspicious entries in WordPress wp_options table related to wishlist settings.

Log IOCs:

• Web server logs showing 200 responses to admin-ajax.php with action=wishlist_* from IPs not associated with authenticated users.
• PHP error logs containing "Undefined index" or "Call to undefined function" related to wishlist functions.

Detection Engineering

YARA Rule

rule CVE_2025_49319_Wishlist_Missing_Auth {
    meta:
        description = "Detects missing authorization in WPFactory Wishlist for WooCommerce"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-49319"
    strings:
        $ajax_hook = /add_action\(['\"]wp_ajax_nopriv_wishlist_/
        $missing_check = /current_user_can\(/ nocase
        $nonce_check = /wp_verify_nonce\(/ nocase
    condition:
        $ajax_hook and not ($missing_check or $nonce_check)
}

Sigma Rule

title: CVE-2025-49319 - Missing Authorization in WPFactory Wishlist
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of missing authorization in Wishlist for WooCommerce plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=wishlist_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated users
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-49319 - Wishlist for WooCommerce Missing Authorization Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=wishlist_"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-49319;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with action=wishlist_* parameters.
3. Add custom code to your theme's functions.php to enforce authorization:

   add_action('init', function() {
       if (defined('DOING_AJAX') && DOING_AJAX) {
           $action = $_REQUEST['action'] ?? '';
           if (strpos($action, 'wishlist_') === 0 && !is_user_logged_in()) {
               wp_die('Unauthorized');
           }
       }
   });
   

Long-term Fix:

• Monitor the WPFactory plugin page for updates.
• Apply the official patch as soon as it becomes available.
• Conduct a security audit of all WordPress plugins for similar authorization issues.

Workaround:

• Restrict access to admin-ajax.php via .htaccess for unauthenticated users (may break other AJAX functionality):

  RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$
  RewriteCond %{HTTP_COOKIE} !wordpress_logged_in_ [NC]
  RewriteRule .* - [F,L]
  

Valters IT
Securing Digital Frontiers