The Wishlist and Save for later for Woocommerce plugin for WordPress suffers from an authorization bypass vulnerability (CWE-639) in all versions up to and including 1.1.22. The vulnerability exists in the 'awwlm_remove_added_wishlist_page' AJAX action, where the plugin fails to properly validate a user-controlled key. This flaw enables authenticated attackers with Subscriber-level privileges or higher to delete wishlist items from other users' wishlists, violating access controls. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges but no user interaction. No official patch or remediation has been identified in the provided data.

An attacker with at least Subscriber-level access can exploit this vulnerability to delete wishlist items from other users. This results in unauthorized modification of user data (integrity impact) but does not affect confidentiality or availability. There is no evidence of known exploits in the wild. The impact is limited to integrity loss within the wishlist functionality of the affected plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected AJAX action or limiting Subscriber-level user capabilities as a temporary mitigation. Monitor official acowebs communications for updates and apply any official fixes promptly once released.