What is the CVSS score of CVE-2026-6419?

CVE-2026-6419 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WishList Member are affected by CVE-2026-6419?

The WishList Member WordPress plugin (versions 3.30.1 and earlier) contains a privilege escalation vulnerability that allows any authenticated site user to extract the REST API secret key and create…

How to fix or mitigate CVE-2026-6419?

24 hours: Deactivate the WishList Member plugin via WordPress dashboard; audit admin accounts for unauthorized additions and review recent login logs. 7 days: Remove the plugin entirely and select an alternative; contact vendor for patch timeline estimate; deploy WAF rules blocking 'ajax_get_screen' requests. 30 days: Confirm plugin removal across all environments; if vendor releases a patch, test in staging before production deployment; reinforce subscriber access governance and monitor admin creation logs.

WishList Member CVE-2026-6419

EUVD-2026-31527 HIGH

Improper Privilege Management (CWE-269)

2026-05-23 Wordfence

GHSA-49p8-c5g6-5pj6

WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 23, 2026 - 05:16 vuln.today

DescriptionCVE.org

The WishList Member plugin for WordPress is vulnerable to Privilege Escalation via Missing Authorization in versions up to and including 3.30.1. This is due to the missing capability and nonce check in the ajax_get_screen() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to supply an arbitrary admin screen identifier via the data[url] parameter, causing the plugin to load and execute the administrative API configuration template without authorization. The rendered HTML, which contains the plugin's plaintext REST API Secret Key, is returned directly to the attacker in the AJAX JSON response. An attacker who obtains this key can authenticate to the WishList Member API, create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.

AnalysisAI

Privilege escalation in the WishList Member WordPress plugin (versions through 3.30.1) allows authenticated subscriber-level attackers to extract the plugin's plaintext REST API Secret Key and use it to create administrator accounts, resulting in full site takeover. The flaw is reachable via a single AJAX call (ajax_get_screen) that lacks capability and nonce checks. No public exploit identified at time of analysis, but the attack path is fully described in the Wordfence advisory and requires only low-privileged authenticated access.

Technical ContextAI

WishList Member is a widely deployed membership/paywall plugin for WordPress that exposes its administrative configuration through internal AJAX endpoints and a REST API protected by a server-side secret key. The root cause is CWE-269 (Improper Privilege Management): the ajax_get_screen() handler accepts a user-supplied data[url] parameter naming an admin screen identifier, then renders the corresponding admin template and returns the resulting HTML in the AJAX response without verifying the caller's capability (e.g., manage_options) or validating a WordPress nonce. Because the admin API configuration screen embeds the plugin's REST API Secret Key directly in its rendered markup, any caller who can reach the endpoint can read the key from the JSON response and subsequently invoke the plugin's REST API to create membership levels bound to the WordPress administrator role and provision new admin users. CPE coverage is cpe:2.3:a:wishlist_member:wishlist_member:*.

RemediationAI

Patch status: no vendor-released patch identified at time of analysis in the provided data; administrators should consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ff0ff4-0878-4e9e-8082-e0f6effef92c) and the vendor site (https://wishlistmember.com/) for a release later than 3.30.1 and upgrade immediately when available. Until a fixed version is installed, deactivate the plugin on sites that allow open user registration, or at minimum disable self-registration so that subscriber-level accounts cannot be freely created (side effect: blocks legitimate new member signups, which may be unacceptable for membership sites - in that case, place the WordPress admin-ajax.php endpoint behind a WAF rule that blocks POST requests to action=ajax_get_screen from non-administrator sessions). After upgrading, rotate the WishList Member REST API Secret Key, audit wp_users for unexpected administrator accounts created after the plugin was installed, and review wp_usermeta and the plugin's membership-level tables for unauthorized levels mapped to the administrator role.