The Addonify – WooCommerce Wishlist plugin suffers from a missing authorization vulnerability in versions up to 2.0.15. This means that certain actions or functions within the plugin can be accessed or triggered without proper access control checks, allowing unauthorized users to perform operations that should be restricted. The CVSS vector indicates the vulnerability is exploitable remotely without privileges or user interaction, with no confidentiality impact but with integrity and availability impacts. No official patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.

Exploitation of this vulnerability can lead to unauthorized modification or disruption of the wishlist functionality, potentially affecting the integrity and availability of the affected system. There is no impact on confidentiality. The medium CVSS score reflects moderate risk due to the lack of required privileges and remote exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin's functionality where possible and monitor for unusual activity related to wishlist operations. Avoid exposing the affected plugin interfaces to untrusted users.