Executive brief
MC Woocommerce Wishlist is a WordPress plugin that allows customers to create and manage product wishlists. A SQL injection vulnerability in versions 1.9.21 and earlier allows administrators with access to the plugin's admin functions to execute arbitrary database queries, potentially exposing, modifying, or deleting sensitive customer data and WordPress configuration.
Technical details
The plugin contains a SQL injection flaw that permits an authenticated administrator to inject malicious SQL code through an unvalidated input parameter. The vulnerability requires administrator-level privileges to exploit and is classified as CWE-89 (SQL Injection). An attacker with admin access can manipulate database queries to read, modify, or delete records—including user accounts, customer orders, and private data. The patch is available in version 2.0.0, and affected deployments should update immediately.
Affected products
- MC Woocommerce Wishlist <= 1.9.21
Timeline
- 2026-09-17: disclosed: Published by Patchstack
- 2026-09-17: patched: Fix available in version 2.0.0