PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6419 Wishlist Member CVE debrief

The WishList Member plugin for WordPress is vulnerable to Privilege Escalation via Missing Authorization in versions up to and including 3.30.1. The vulnerability exists in the ajax_get_screen() function, which lacks proper capability and nonce checks. Authenticated attackers with Subscriber-level access or higher can exploit this by supplying an arbitrary admin screen identifier through the data[url] parameter. This causes the plugin to load and execute the administrative API configuration template without authorization, returning the rendered HTML containing the plugin's plaintext REST API Secret Key directly to the attacker in the AJAX JSON response. With this key, an attacker can authenticate to the WishList Member API, create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.

Vendor
Wishlist Member
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-23
Original CVE updated
2026-07-23
Advisory published
2026-05-23
Advisory updated
2026-07-23

Who should care

WordPress site administrators using WishList Member plugin; security teams responsible for WordPress security posture; hosting providers managing WordPress installations; incident responders investigating potential site compromises

Technical summary

The ajax_get_screen() function in WishList Member ≤3.30.1 fails to verify user capabilities or nonces before processing requests. Attackers with minimal authentication (Subscriber+) can manipulate the data[url] parameter to force rendering of administrative templates, specifically the API configuration screen. The response includes the unencrypted REST API Secret Key, which serves as a bearer token for the WishList Member API. This API access enables creation of membership levels with arbitrary WordPress role assignments and subsequent user registration with elevated privileges, achieving unauthenticated administrative access to the WordPress installation.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade WishList Member plugin to a version newer than 3.30.1
  • Review WordPress user accounts for unauthorized administrator-level accounts created via membership levels
  • Rotate the WishList Member REST API Secret Key if compromise is suspected
  • Implement least-privilege access controls and regularly audit user roles
  • Consider implementing additional authentication controls for administrative API endpoints
  • Monitor for unauthorized access to the WishList Member API using extracted credentials

Evidence notes

The vulnerability description is sourced from the official NVD record, which references Wordfence as the primary source. The CVSS 3.1 score of 8.8 (HIGH) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact to confidentiality, integrity, and availability. The weakness is classified as CWE-269 (Improper Privilege Management).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6419 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6419

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6419 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6419

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.