WishList Member CVE-2026-6419

Requires an authenticated WordPress session at subscriber level or above on a site running WishList Member ≤ 3.30.1; in practice this bar is low because membership sites using this plugin typically permit open self-registration. Exploitation needs network reach to /wp-admin/admin-ajax.php and the ability to issue a POST with action=ajax_get_screen and a data[url] value identifying the plugin's admin API configuration screen. No user interaction by an administrator is required, no non-default plugin configuration is needed, and the vulnerable handler is present in the default install. The limiting factors are therefore (a) the site must accept new low-privileged registrations or the attacker must otherwise obtain subscriber credentials, and (b) the plugin must be ≤ 3.30.1.

The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) is consistent with the description: network reachable, low complexity, low-privilege authenticated, no user interaction, with full CIA impact via administrator account creation. The PR:L requirement is a meaningful brake - exploitation requires at least subscriber-level credentials, which on many membership sites are trivially obtainable through self-registration (a deployment pattern very common for WishList Member's target audience), effectively collapsing the privilege barrier in practice. No EPSS score, KEV listing, or SSVC decision was provided in the input, and no public exploit was identified at time of analysis, so real-world exploitation telemetry is unknown; however, the attack is straightforward (single AJAX request to extract a key, followed by documented REST calls) and the underlying product is a paid membership plugin with broad WordPress install base, making opportunistic exploitation plausible once details circulate. There is no conflict between the CVSS signals and the description.

An attacker self-registers a free subscriber account on a WordPress site running WishList Member ≤ 3.30.1, then sends a single authenticated POST to admin-ajax.php invoking ajax_get_screen with data[url] pointing at the API configuration screen; the JSON response contains the plaintext REST API Secret Key. Using that key, the attacker calls the WishList Member REST API to create a new membership level bound to the WordPress administrator role and registers an account assigned to that level, gaining full site takeover. No public exploit code was identified at time of analysis, but the Wordfence write-up describes each step.