Wishlist Member vulnerabilities

The Wishlist Member plugin for WordPress up to version 3.34.1 is vulnerable to account takeover due to insufficient verification of data authenticity. The wpm_register() function validates the registration cookie only against the GET reg parameter while accepting POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a temporary or incomplete registrant bound to the current registration transaction. This allows unauthenticated attackers to take over any existing WordPress account, including administrator accounts, by supplying an arbitrary user's numeric ID as the mergewith value, causing wp_update_user() to overwrite the target account's username, password, email address, first name, and last name with attacker-controlled values, while WordPress password and email change notification emails are explicitly suppressed.

The Wishlist Member plugin for WordPress up to version 3.30.1 lacks proper capability checks in the 'WishListMember\Features\Team_Accounts::save_settings' function. This allows authenticated attackers with Subscriber-level access or higher to modify arbitrary plugin options, including the REST API Secret Key.

The WishList Member plugin for WordPress up to version 3.30.1 has a privilege escalation vulnerability due to missing authorization in the ajax_get_screen() function. An authenticated attacker with Subscriber-level access can supply an admin screen identifier, causing the plugin to load the API configuration template and return the REST API Secret Key in the AJAX response.