CVE-2026-15261

{
  "etk_id": "ETK-2026-2297",
  "cve_id": "CVE-2026-15261",
  "display_id": "CVE-2026-15261",
  "ghsa_id": "GHSA-84p5-6x2c-h74j",
  "euvd_id": "EUVD-2026-107080",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated private wishlist disclosure in TI WooCommerce Wishlist",
  "summary": "TI WooCommerce Wishlist versions before 2.13.0 expose private wishlist information through insufficient REST API access controls. An unauthenticated attacker can read private wishlist metadata and item contents when the affected plugin is installed and private wishlists are present.",
  "mitigation": "Upgrade TI WooCommerce Wishlist to version 2.13.0 or later. Restrict public access to the affected REST API endpoints until the update is applied.",
  "vendor": null,
  "product": "TI WooCommerce Wishlist",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.13.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.13.0"
      ],
      "package_name": "TI WooCommerce Wishlist",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 28.173382183333334,
  "t0_at": "2026-10-21T06:00:23.908000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-21T07:57:18.926802+00:00",
      "days": 0.08119234724537037,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T06:00:23.908000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-21T06:00:23.908000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T06:00:23.908000+00:00",
      "url": "https://github.com/advisories/GHSA-84p5-6x2c-h74j"
    }
  }
}