YITH WooCommerce Wishlist up to and including 4.10.0 exposes YITH_WCWL_Wishlists::create() through the unauthenticated REST route /wp-json/yith/wishlist/v1/lists, which registers permission_callback => ‘__return_true’. Because create() accepted a caller-supplied user_id without checking who was asking, an unauthenticated attacker could have a wishlist created for, and its token returned for, any user id – disclosing that user’s wishlist token and enabling the attacker to rename the wishlist or delete its items (CVE-2025-12777 and CVE-2025-12427, both CVSS 5.3). Version 4.10.1 adds an ownership check inside create(), throwing YITH_WCWL_Exception unless the current user is the target user or holds the manage_woocommerce capability.
This vulnerability affects the following application versions:
- YITH WooCommerce Wishlist 4.0.0
- YITH WooCommerce Wishlist 4.0.1
- YITH WooCommerce Wishlist 4.1.0
- YITH WooCommerce Wishlist 4.2.0
- YITH WooCommerce Wishlist 4.3.0
- YITH WooCommerce Wishlist 4.4.0
- YITH WooCommerce Wishlist 4.5.0
- YITH WooCommerce Wishlist 4.6.0
- YITH WooCommerce Wishlist 4.7.0
- YITH WooCommerce Wishlist 4.8.0
- YITH WooCommerce Wishlist 4.9.0
- YITH WooCommerce Wishlist 4.10.0