CVE-2025-11532 is an authorization bypass vulnerability in the Wisly plugin for WordPress, affecting all versions up to 1.0.0. The issue arises from insufficient validation of the 'wishlist_id' parameter, which is user-controlled. This flaw allows unauthenticated attackers to manipulate other users' wishlists by adding or removing items without proper authorization checks. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 score of 5.3 reflects a medium severity with network attack vector, no privileges required, and no user interaction needed. No patch or official remediation has been documented, and the product is not a cloud service, so remediation depends on vendor updates.

An attacker can modify other users' wishlists by adding or removing items without authentication. This impacts the integrity of user data within the Wisly plugin but does not affect confidentiality or availability. The vulnerability could lead to unauthorized changes in user-specific data, potentially causing user confusion or loss of trust in the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently available, users should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the plugin or disabling it if feasible to prevent exploitation.