PrestaShop blockwishlist versions through 3.0.2 contain an authorization bypass vulnerability in the getUrlByIdWishListAction method. The module fails to validate wishlist ownership properly, allowing authenticated users to supply sequential wishlist identifiers to retrieve valid share tokens. This flaw permits unauthorized reading of other customers' private wishlist contents by exploiting the lack of ownership verification.

An attacker with authenticated access can enumerate wishlist identifiers and obtain share tokens for wishlists they do not own. This leads to unauthorized disclosure of private wishlist data belonging to other customers. The vulnerability does not require user interaction and has a low complexity of attack but requires authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the blockwishlist module to trusted users only and monitor for unusual access patterns. Avoid sharing wishlist identifiers publicly.