What is the CVSS score of CVE-2026-25445?

CVE-2026-25445 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Membership Software WishList Member are affected by CVE-2026-25445?

WishList Member X, a WordPress membership plugin used on our sites, contains a critical vulnerability (CVSS 8.8) that allows attackers with low-level user access to inject malicious code and…

How to fix or mitigate CVE-2026-25445?

Within 24 hours: Audit all WordPress installations for WishList Member X versions ≤3.29.0 and document affected sites. Within 7 days: Implement WAF rules blocking serialized object injection attempts, restrict plugin admin access to essential personnel only, and disable membership-related forms if feasible. Within 30 days: Either migrate to an alternative membership plugin or deactivate WishList Member X entirely; monitor Patchstack for patch availability and plan immediate deployment upon release.

Membership Software WishList Member CVE-2026-25445

EUVD-2026-13083 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-19 audit@patchstack.com

Deserialization

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 19, 2026 - 09:22 euvd

EUVD-2026-13083

Analysis Generated

Mar 19, 2026 - 09:22 vuln.today

CVE Published

Mar 19, 2026 - 09:16 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a through 3.29.0.

AnalysisAI

WishList Member X, a WordPress membership plugin, contains a deserialization of untrusted data vulnerability that allows authenticated attackers with low-level privileges to perform PHP object injection attacks. This affects all versions up to and including 3.29.0. The vulnerability has a CVSS score of 8.8, indicating high severity with potential for complete compromise of confidentiality, integrity, and availability. There is no indication of active exploitation in KEV data, but the vulnerability has been publicly disclosed by Patchstack.

Technical ContextAI

This vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a dangerous class of flaws where applications accept serialized objects from untrusted sources and instantiate them without proper validation. In PHP applications like WishList Member X, unsafe deserialization can trigger magic methods (__wakeup, __destruct, __toString) in arbitrary classes, enabling attackers to execute malicious code, manipulate application logic, or access sensitive data. The affected product is the WishList Member X WordPress plugin, a membership management solution that controls access to premium content on WordPress sites. When user-controlled serialized data is processed through PHP's unserialize() function without sanitization, attackers can inject specially crafted objects that exploit existing code within the application or its dependencies to achieve remote code execution or other malicious outcomes.

RemediationAI

Immediately upgrade WishList Member X to a version newer than 3.29.0 that addresses this deserialization vulnerability. Consult the official WishList Member support channels and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wishlist-member-x/vulnerability/wordpress-wishlist-member-x-plugin-3-29-0-php-object-injection-vulnerability?_s_id=cve for the patched version number and update instructions. Until patching is completed, consider temporarily disabling the plugin if membership functionality is not mission-critical, or restrict user registration to prevent untrusted accounts from exploiting the low-privilege requirement. Implement Web Application Firewall (WAF) rules to detect and block serialized PHP objects in user inputs, though this should only be considered a temporary compensating control. Review WordPress user accounts for suspicious registrations and audit admin/elevated privilege users for unauthorized access that may have occurred through exploitation. After patching, conduct a security review to ensure no persistent backdoors were installed during the vulnerability window.