CVE-2026-6897
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Wishlist Member plugin for WordPress up to version 3.30.1 lacks proper capability checks in the 'WishListMember\Features\Team_Accounts::save_settings' function. This allows authenticated attackers with Subscriber-level access or higher to modify arbitrary plugin options, including the REST API Secret Key.
Risk Assessment
An attacker can use this key to create a new membership level with the administrator role and register an arbitrary administrator account, leading to complete site takeover.
Recommendation
Update the Wishlist Member plugin to the latest available version that fixes the missing capability check.
Other vulnerabilities in Wishlist Member
See all- CVE-2026-12949Critical
The Wishlist Member plugin for WordPress up to version 3.34.1 is vulnerable to account takeover due to insufficient verification of data authenticity. The wpm_register() function validates the registration cookie only against the GET reg parameter while accepting POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a temporary or incomplete registrant bound to the current registration transaction. This allows unauthenticated attackers to take over any existing WordPress account, including administrator accounts, by supplying an arbitrary user's numeric ID as the mergewith value, causing wp_update_user() to overwrite the target account's username, password, email address, first name, and last name with attacker-controlled values, while WordPress password and email change notification emails are explicitly suppressed.
- CVE-2026-6419High
The WishList Member plugin for WordPress up to version 3.30.1 has a privilege escalation vulnerability due to missing authorization in the ajax_get_screen() function. An authenticated attacker with Subscriber-level access can supply an admin screen identifier, causing the plugin to load the API configuration template and return the REST API Secret Key in the AJAX response.
Original NVD description (English source)
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\Features\Team_Accounts::save_settings' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options, includes the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.