CVE-2026-6419
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The WishList Member plugin for WordPress up to version 3.30.1 has a privilege escalation vulnerability due to missing authorization in the ajax_get_screen() function. An authenticated attacker with Subscriber-level access can supply an admin screen identifier, causing the plugin to load the API configuration template and return the REST API Secret Key in the AJAX response.
Risk Assessment
An attacker can obtain the API key, create a new membership level with administrator role, and register an administrator account, leading to full takeover of the WordPress site.
Recommendation
Update the WishList Member plugin to a version later than 3.30.1 that includes the authorization fix.
Other vulnerabilities in WishList Member
See all- CVE-2026-12949Critical
The Wishlist Member plugin for WordPress up to version 3.34.1 is vulnerable to account takeover due to insufficient verification of data authenticity. The wpm_register() function validates the registration cookie only against the GET reg parameter while accepting POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a temporary or incomplete registrant bound to the current registration transaction. This allows unauthenticated attackers to take over any existing WordPress account, including administrator accounts, by supplying an arbitrary user's numeric ID as the mergewith value, causing wp_update_user() to overwrite the target account's username, password, email address, first name, and last name with attacker-controlled values, while WordPress password and email change notification emails are explicitly suppressed.
- CVE-2026-6897High
The Wishlist Member plugin for WordPress up to version 3.30.1 lacks proper capability checks in the 'WishListMember\Features\Team_Accounts::save_settings' function. This allows authenticated attackers with Subscriber-level access or higher to modify arbitrary plugin options, including the REST API Secret Key.
Original NVD description (English source)
The WishList Member plugin for WordPress is vulnerable to Privilege Escalation via Missing Authorization in versions up to and including 3.30.1. This is due to the missing capability and nonce check in the ajax_get_screen() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to supply an arbitrary admin screen identifier via the data[url] parameter, causing the plugin to load and execute the administrative API configuration template without authorization. The rendered HTML, which contains the plugin's plaintext REST API Secret Key, is returned directly to the attacker in the AJAX JSON response. An attacker who obtains this key can authenticate to the WishList Member API, create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.