This vulnerability in WPFactory Wishlist for WooCommerce (<= 3.2.3) is due to missing authorization checks, which means that the plugin does not properly enforce access control for certain operations. This allows an attacker without privileges to perform actions that should be restricted, potentially affecting data integrity and availability. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity and availability.

Exploitation of this vulnerability could allow an unauthenticated attacker to perform unauthorized actions within the Wishlist for WooCommerce plugin, potentially modifying or disrupting wishlist data. Confidentiality is not impacted. There are no known exploits in the wild, and no direct evidence of active attacks has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying principle of least privilege and restricting access to the plugin’s functionality where possible may reduce risk.