CVE-2025-13157 is an insecure direct object reference vulnerability in the QODE Wishlist for WooCommerce plugin for WordPress, affecting all versions up to and including 1.2.7. The vulnerability arises from the 'qode_wishlist_for_woocommerce_wishlist_table_item_callback' function, which fails to validate a user-controlled key, enabling unauthorized modification of wishlist public views by unauthenticated attackers. This issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker without authentication can update the public view of arbitrary wishlists, potentially altering wishlist data visible to users. There is no confidentiality or availability impact reported. The integrity of wishlist data is partially impacted due to unauthorized modifications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying any available plugin updates promptly once released is recommended. No specific temporary mitigations are provided in the current data.