{"affected":[{"defaultStatus":"unaffected","product":"TI WooCommerce Wishlist","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.13.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-124648","cwes":["CWE-863"],"description":"The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/528218ee-f437-4028-aae0-022435cbb66e/"}],"kev":null,"metrics":[],"modifiedAt":1794463208998,"publishedAt":1794463208998,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/528218ee-f437-4028-aae0-022435cbb66e/"}],"remediation":[],"revision":"6caa1a030b8423094b31de2e5a7a995699febe0222aafd05fbdcd185ed9ec9b2","sources":[{"modifiedAt":1794463208998,"name":"CNA: WPScan","retrievedAt":1794467318914,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124648"}],"ssvc":null,"status":"published","title":"TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key","updatedAt":1794467318914}