CVE-2026-6897

The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\Features\Team_Accounts::save_settings' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options, includes the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://wishlistmember.com/
https://www.wordfence.com/threat-intel/vulnerabilities/id/db251792-cbad-41e1-aaca-4cd39a25b444?source=cve

Configurations

No configuration.

History

23 Jul 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) El plugin Wishlist Member para WordPress es vulnerable a la modificación no autorizada de datos debido a una comprobación de capacidad faltante en la función 'WishListMember\Features\Team_Accounts::save_settings' en todas las versiones hasta la 3.30.1, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, actualicen opciones arbitrarias del plugin, incluyendo la Clave Secreta de la API REST, que puede ser utilizada para crear un nuevo nivel de membresía asignado el rol de administrador de WordPress, y registrar una cuenta de usuario arbitraria de nivel administrador, resultando en una toma de control completa del sitio.

23 May 2026, 05:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-23 05:16

Updated : 2026-07-23 11:10

NVD link : CVE-2026-6897

Mitre link : CVE-2026-6897

CVE.ORG link : CVE-2026-6897

JSON object : View

Products Affected

No product.

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2026-6897", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6897", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-26T14:38:58.140307Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "Wishlist Member", "product": "Wishlist Member", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.30.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-23T05:16:34.407", "references": [{"url": "https://wishlistmember.com/", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/db251792-cbad-41e1-aaca-4cd39a25b444?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\\Features\\Team_Accounts::save_settings' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options, includes the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover."}, {"lang": "es", "value": "El plugin Wishlist Member para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n 'WishListMember\\Features\\Team_Accounts::save_settings' en todas las versiones hasta la 3.30.1, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, actualicen opciones arbitrarias del plugin, incluyendo la Clave Secreta de la API REST, que puede ser utilizada para crear un nuevo nivel de membres\u00eda asignado el rol de administrador de WordPress, y registrar una cuenta de usuario arbitraria de nivel administrador, resultando en una toma de control completa del sitio."}], "lastModified": "2026-07-23T11:10:00.120", "sourceIdentifier": "security@wordfence.com"}