TI WooCommerce Wishlist CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review TI WooCommerce Wishlist CVE published 2026-10-21

CVE-2026-15261

The TI WooCommerce Wishlist plugin before version 2.13.0 does not enforce the same owner-only access control on its REST API as it does on the front-end, allowing unauthenticated users to read metadata and item contents of private wishlists via the share_key. This vulnerability affects WordPress installations with the TI WooCommerce Wishlist plugin, potentially leading to unauthorized access to sensitive [truncated]