TI WooCommerce Wishlist: unauthenticated SQL injection (CVE-2026-124647)
A vulnerability, CVE-2026-124647 (CVSS 8.6), was published for the TI WooCommerce Wishlist WordPress plugin. User input is not sanitised or escaped before being used in a SQL statement in a front-end endpoint.
Checked in Shield: no
Who is affected
Sites running TI WooCommerce Wishlist before version 2.0.7. The attack can be carried out by unauthenticated users.
How to check
In the WordPress admin, open the Plugins page and check the TI WooCommerce Wishlist version. If it is below 2.0.7, the site is vulnerable.
How to fix
A fix is available in version 2.0.7. Update the plugin to 2.0.7 or newer, and back up the site before updating.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the issue is exploited is not disclosed yet, and attack details are not public. Source: NVD.
