The WooCommerce Wishlist vulnerability affects an online store plugin for WordPress and scores 9.1 out of 10 per the NVD listing. If your storefront uses it, we recommend having your IT provider identify it, then patch or remove it, after a verified backup.
What is it?
A visitor without an account can change certain settings on your site and make it unusable.
The National Vulnerability Database (NVD), maintained by NIST, lists it as CVE-2026-124763. The flaw sits in a plugin, meaning a module added to a WordPress site to give it an extra function, in this case a wishlist for customers. According to the NVD listing, one of the plugin’s commands accepts requests from any visitor, without checking who is sending them or where they come from. It’s the garage door left open for the weekend: the house locks are fine, but one entry point was overlooked. The listing describes the possible outcome: a change to the site’s address or the deactivation of plugins, leaving a store that no longer responds.
Why is it serious?
9.1 out of 10 per the NVD listing, and no exploitation reported to date in that listing.
That 9.1 score was assigned by the reporting organization (CNA) per the NVD listing, on the CVSS 3.1 scale, which rates technical severity from 0 to 10. Nothing points to an active attack right now, and we see that as a window worth using without delay. The business risk here isn’t a dramatic theft, it’s a shutdown: orders that stop coming in, customers facing an error page, a day lost getting the site back up.
Who is affected?
WordPress stores running WooCommerce Wishlist, in every version up to and including 1.1.0.
The product in question is the WooCommerce Wishlist plugin for WordPress, versions 1.1.0 and earlier. The developer isn’t named in the NVD listing, and no patched version is indicated there either: that gap in information changes what you should do next. We encourage any organization running a WordPress store to check for this plugin, regardless of its size.
How do I check my business?
Whether the plugin is installed, which version, and whether a backup actually restores.
- Have someone open the WordPress dashboard, Plugins section, to see whether WooCommerce Wishlist is present and which version is active (IT provider).
- Ask whether a patched version exists and have it installed as soon as it’s released (site developer or software vendor).
- Confirm that a full backup exists and that a restore test has already succeeded (management).
- Ask whether a web application firewall, a filter placed in front of the site, and automatic updates are in place (hosting provider).
Scenario
Fictional example: an independent garage selling tires and accessories through its WordPress site.
Friday morning, the site shows an error. The catalogue won’t open and the appointment form stays silent. The IT provider calls back by late morning, finds that settings have changed, then looks for a backup: the last one is several weeks old. The day goes to phone calls instead of the shop floor, and customers who booked online need to be called back.
What to do now
We recommend working through these steps with your provider, in order:
- Take inventory of the site’s plugins and note their version.
- Back up the full site and confirm the backup restores before making any changes.
- Remove the plugin if the wishlist feature isn’t essential to your sales.
- Install the patched version as soon as it’s released, staying in contact with your hosting provider.
What the WooCommerce Wishlist Vulnerability Means for a Local Business
For a Canadian business, what’s at stake is the ability to sell on Monday morning. A store also holds personal information. Quebec’s Act respecting the protection of personal information in the private sector (RLRQ, c. P-39.1) requires a log of confidentiality incidents. It also requires notifying the Commission d’accès à l’information (Quebec’s privacy regulator) when there is a risk of serious harm. The baseline controls from the Canadian Centre for Cyber Security point to the same steps: inventory, updates, tested backups. We’ll say it plainly: there is no absolute protection, and no provider can guarantee zero risk, but these steps meaningfully reduce exposure.
FAQ
Should the site be taken offline in the meantime?
Not necessarily. Start by finding out whether the plugin is present and active. If it is, and no patched version has been released, we recommend removing it rather than waiting, after a verified backup.
No attack has been reported, so why act right away?
The NVD listing reports no exploitation to date, and we’d rather act during that window. A planned fix means a verified backup, a restore test, and work done on a schedule that suits you. After an incident, the same steps get done under pressure, sometimes without a recent backup, and the store can stay down while things get restored.
My business is small, am I really affected?
We can’t answer that based on size alone. The NVD listing describes a flaw in a plugin: what determines your exposure is whether that plugin is on your site, and which version. The Canadian Centre for Cyber Security’s baseline controls, in fact, are written specifically for small and medium organizations.
Sources
- NVD listing for CVE-2026-124763 · NIST, November 13, 2026
- Canadian Centre for Cyber Security: Baseline Cyber Security Controls for Small and Medium Organizations · reference control list
- Act respecting the protection of personal information in the private sector (RLRQ, c. P-39.1) · official up-to-date text
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-124763
This article was prepared by RISS Canada’s threat-monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial standards.
