CVE-2025-13440 is a missing authorization vulnerability (CWE-862) in the Premmerce Wishlist for WooCommerce plugin for WordPress. In all versions up to and including 1.1.10, the deleteWishlist() function does not perform a capability check, enabling authenticated users with Subscriber-level privileges or higher to delete wishlists arbitrarily. This could lead to unauthorized modification of wishlist data. The vulnerability has a CVSS 3.1 score of 5.3, reflecting a medium impact primarily on integrity. No patch or official fix has been documented in the provided data.

An authenticated attacker with at least Subscriber-level access can delete arbitrary wishlists, impacting the integrity of user data within the plugin. There is no indication of confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals and monitor for suspicious activity related to wishlist deletions. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the Premmerce vendor for any forthcoming patches or official mitigations.