{"id":3318,"date":"2025-05-29T07:12:30","date_gmt":"2025-05-29T06:12:30","guid":{"rendered":"https:\/\/aegislens.com\/home\/?p=3318"},"modified":"2025-05-29T07:12:30","modified_gmt":"2025-05-29T06:12:30","slug":"critical-security-risk-endangers-over-100000-wordpress-websites-vulnerability-in-wishlist-plugin-explained","status":"publish","type":"post","link":"https:\/\/aegislens.com\/home\/critical-security-risk-endangers-over-100000-wordpress-websites-vulnerability-in-wishlist-plugin-explained\/","title":{"rendered":"Critical Security Risk Endangers Over 100,000 WordPress Websites: Vulnerability in Wishlist Plugin Explained"},"content":{"rendered":"

networks.<\/p>\n

Vulnerability Details<\/h2>\n

Cybersecurity experts from NinTechNet have discovered the critical Common Vulnerability Scoring System (CVSS) 10.0 vulnerability in TI WooCommerce Wishlist plugin for WordPress.<\/p>\n

This CVE-tagged flaw, open to exploitation by unauthenticated actors, permits arbitrary file uploads.<\/p>\n

The vulnerability is a file upload type known as an \u201cunauthenticated arbitrary file upload\u201d vulnerability that grants a hacker the ability to upload malicious files onto a server.<\/p>\n

In layman’s terms, this flaw can enable a cybercriminal to take full control of a website.<\/p>\n

Specifically, the defect is in the plugin’s AJAX action feature.<\/p>\n

The compromised AJAX endpoint `ti-wishlist-upload-image` does not have sufficient security checks or authentication, potentially leading to arbitrary file uploads that can be exploited further for arbitrary code execution (ACE).<\/p>\n

Implications and Potential Damage<\/h2>\n

The reported vulnerability poses severe threats to web security, in particular to the owners of WooCommerce-based e-commerce stores.<\/p>\n

A successful exploitation could allow an attacker to take control of a website, enabling them to perform actions such as data theft, defacement of the website, establishment of backdoors, and further spreading of malware to visitors of the site.<\/p>\n

Current Status and Advice<\/h2>\n

As of now, there’s no patch available for this high-risk vulnerability.<\/p>\n

Plugin developers, Template Invaders, have been notified by the researchers, but they have not yet taken effective actions to rectify or patch the problem.<\/p>\n

For the meantime, website administrators using the said plugin are encouraged to disable it until a security patch becomes available.<\/p>\n

The disabling act will remove any potential risks of exploitation and the eventual loss of sensitive data.<\/p>\n

An alternate solution is to place the website behind a Web Application Firewall (WAF) which can block exploitation attempts.<\/p>\n

Follow-Up Reading<\/h2>\n

Stay updated on the latest news and updates on this ongoing issue with these trusted sources:<\/p>\n