CVE-2025-13440: 
WordPress vulnerability analysis and mitigation

CVE-2025-13440 is a Missing Authorization vulnerability in the Premmerce Wishlist for WooCommerce plugin for WordPress. Due to a missing capability check on the deleteWishlist() function, authenticated attackers with Subscriber-level access or above can delete arbitrary wishlists. All plugin versions up to and including 1.1.10 are affected. The vulnerability was published on December 12, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the deleteWishlist() function in src/Admin/Admin.php (line 334) does not perform a capability check before processing deletion requests, allowing any authenticated user regardless of role to invoke it. The attack vector is network-accessible, requires no user interaction, and has low attack complexity — an attacker simply needs a valid WordPress account at Subscriber level or higher to send a crafted request targeting another user's wishlist. The vulnerable code is publicly visible in the plugin's source repository (WordPress Trac, Wordfence).

Successful exploitation allows an authenticated attacker to delete any user's wishlist data on the affected WordPress/WooCommerce installation, resulting in an integrity impact against stored user data. There is no confidentiality or availability impact — attackers cannot read private data or cause service disruption. The scope is limited to wishlist records within the affected plugin, with no known path to lateral movement or privilege escalation (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13440. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Subscriber-level WordPress account, limiting the attacker pool compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain authenticated access: Register or log in to the target WordPress site with at least a Subscriber-level account.
2. Identify target wishlists: Browse the WooCommerce store or enumerate wishlist IDs through normal site interaction or by observing wishlist-related URLs/parameters.
3. Craft deletion request: Send an authenticated HTTP request (e.g., POST or AJAX call) to the endpoint that invokes the deleteWishlist() function, supplying the ID of an arbitrary target wishlist belonging to another user.
4. Achieve unauthorized deletion: Because no capability check is performed, the server processes the request and deletes the specified wishlist, regardless of ownership (WordPress Trac, Wordfence).

• Logs: WordPress access logs showing repeated requests to the wishlist deletion endpoint from a single low-privileged user account, particularly targeting wishlist IDs not owned by that user.
• Database: Unexpected mass deletion of wishlist records in the WooCommerce/Premmerce wishlist database tables, especially across multiple user accounts.
• Application Logs: WordPress debug logs or WooCommerce logs recording deleteWishlist() calls initiated by Subscriber-level users at unusual frequency or volume.

Site administrators should update the Premmerce Wishlist for WooCommerce plugin to a version beyond 1.1.10 that includes a proper capability check in the deleteWishlist() function. If an immediate update is not possible, consider restricting plugin functionality or temporarily disabling the plugin until a patched release is available. Monitor the WordPress plugin repository for an updated release from the Premmerce vendor (Wordfence, WordPress Trac).