CVE-2025-11518 is an insecure direct object reference vulnerability in the WPC Smart Wishlist for WooCommerce WordPress plugin, affecting all versions up to and including 5.0.3. The vulnerability stems from inadequate validation of a user-controlled key used in AJAX wishlist functions, which is exposed when wishlists are shared. This allows unauthenticated attackers who obtain the key to bypass authorization controls and modify other users' wishlists by adding or removing items without permission. The vulnerability does not impact confidentiality or availability but allows integrity compromise of wishlist data.

An attacker who obtains the user-controlled key can manipulate the contents of other users' wishlists without authentication. This results in unauthorized modification (integrity impact) of wishlist data. There is no direct impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to shared wishlist keys and monitor for suspicious activity related to wishlist modifications. Avoid sharing wishlist keys publicly. Follow vendor updates for patches or official fixes.