Threats tagged 'ghsa-5r94-pf8r-75v2'

The YITH WooCommerce Wishlist plugin for WordPress versions up to and including 4.10.0 contains an Insecure Direct Object Reference (IDOR) vulnerability via its REST API and AJAX handler. This flaw allows unauthenticated attackers to discover any user's wishlist token ID and rename the victim's wishlist without authorization. The vulnerability impacts data integrity and can be exploited for defacement, social engineering, mass tampering, and user profiling in multi-user store environments.