WishList Member X CVE-2026-24575

Exploitation requires a valid WordPress subscriber account on the target site - the lowest authenticated WordPress role, freely obtainable on any site with open user registration enabled. The WishList Member X plugin must be installed and active (version ≤ 3.29.0). Sites that have disabled subscriber self-registration or require manual account approval are not remotely exploitable by anonymous attackers. The CVSS AC:L metric confirms no additional configuration state, race condition, or complex setup is needed beyond holding the subscriber credential. Exploitation is bounded to confidentiality (C:L) - specifically, unauthorized viewing of membership-protected content - with no modification or disruption of site data (I:N, A:N).

The NVD CVSS score of 4.3 (Medium) accurately reflects the constrained blast radius: confidentiality impact is Low (restricted content exposure only), with no integrity or availability impact. The PR:L metric is the key limiting signal - a valid subscriber account is a prerequisite, restricting exploitation to registered users. The attack complexity is Low (AC:L), meaning no race conditions or special configurations beyond the plugin being active are required. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified beyond CVSS. The vulnerability is not listed in the CISA KEV catalog, and no POC has been identified, indicating no confirmed active or opportunistic exploitation. The 'Authentication Bypass' tag in the source data overstates the issue - this is an authorization bypass within an authenticated session, not a bypass of the authentication mechanism itself. Real-world business risk is highest for sites offering free subscriber sign-ups alongside paid membership tiers, as any freely-registered user could access premium content, undermining the site's revenue model.

An attacker registers a free subscriber account on a WordPress site running WishList Member X ≤ 3.29.0 with open registration enabled. Authenticated as a subscriber, they send direct HTTP requests to URLs or endpoints serving membership-gated content, which the plugin serves without validating the user's membership tier. The low attack complexity (AC:L) suggests exploitation requires only knowledge of the restricted content URL, with no further tooling or chaining required.