CVE-2025-12427 is an insecure direct object reference vulnerability (CWE-639) in the YITH WooCommerce Wishlist WordPress plugin up to version 4.10.0. The issue arises from missing validation on user-controlled keys in the REST API endpoint and AJAX handler, enabling unauthenticated attackers to enumerate wishlist token IDs and rename wishlists belonging to other users without authorization. This vulnerability affects the integrity of user data and can be leveraged for defacement, social engineering, and large-scale tampering in multi-user e-commerce stores.

The vulnerability allows unauthenticated attackers to modify other users' wishlist names without permission, compromising the integrity of wishlist data. This could lead to defacement of user content, manipulation for social engineering attacks, and profiling of users at scale. There is no impact on confidentiality or availability reported. No known exploits in the wild have been identified as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the REST API and AJAX endpoints or implementing additional access controls may reduce exposure.