CVE-2026-124647 PUBLISHED

TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie

Assigner: WPScan
Reserved: 09.11.2026 Published: 12.11.2026 Updated: 12.11.2026

The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using it in a SQL statement in a front-end endpoint, allowing unauthenticated users to perform SQL injection attacks.

Product Status

Vendor Unknown
Product TI WooCommerce Wishlist
Versions Default: unaffected
  • affected from 0 to 2.0.7 (excl.)

Credits

  • Seid Yassin Ali finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE