Unauthenticated account takeover in Wishlist Member plugin for WordPress (CVE-2026-12949)

The Wishlist Member plugin for WordPress contains an insufficient verification of data authenticity flaw in the wpm_register() function. The function validates the registration cookie only against the GET reg parameter while accepting POST parameters mergewith and wpm_id without verifying that the mergewith user ID is bound to the current registration transaction. An unauthenticated attacker can supply an arbitrary user's numeric ID as the mergewith value to overwrite any account's credentials with attacker-controlled values, with password and email change notifications explicitly suppressed, enabling full account takeover including administrator-level accounts. Affected versions: - <= 3.34.1 We recommend updating to: 3.34.2. CVSS 9.8 · our assessment: act_now Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/84afe5a7-1bf4-4b83-bf77-efbb003a30cd?source=cve Details: https://vuln.today/cve/CVE-2026-12949