Plugin is vulnerable to unauthenticated wishlist deletion

  • Tofandel

    (@tofandel)


    5 months ago

    Currently there is no check in remove_all_from_wish_list wether the user id passed is the currently logged in user, this means anyone can just run this ajax hook over a list of ids (which are very easy to guess because incremental) and delete all the items in all the wishlists of everyone

Viewing 1 replies (of 1 total)
  • Plugin Author Pablo Pacheco

    (@karzin)

    Hi @tofandel ,

    I believe I have been able to fix the issue on version 3.1.1 I just released.

    Please, update the plugin and let me know if it helps.

Viewing 1 replies (of 1 total)
  • You must be logged in to reply to this topic.