WishList Member CVE-2026-6895

Exploitation requires a low-privileged authenticated WordPress session on a site running WishList Member ≤3.30.1 (CVSS PR:L), which on membership-oriented deployments - the plugin's intended use case - is typically trivial because open user registration is commonly enabled; no user interaction is needed (UI:N) and the request is reachable over the network (AV:N). The specific feature required is the plugin's 'export_settings' AJAX action, and the chain only completes if the plugin's REST API (which accepts the leaked Secret Key for membership-level creation with WordPress role mapping) is also reachable. Limiting factors: sites where the plugin is not installed or already upgraded past 3.30.1 are not affected, and sites that block self-registration force an attacker to first obtain or phish any low-privilege credential before exploitation.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full impact across the CIA triad - a realistic and high-priority risk for any site that allows untrusted user registration (a common configuration for membership sites running this very plugin). The vulnerability is not listed in CISA KEV and no EPSS score or public exploit was provided in the input, so no public exploit identified at time of analysis; however, the disclosure path through Wordfence and the trivial exploit chain described in the advisory mean weaponization within Wordfence's WAF-rule disclosure window is plausible. Note a tension in the available data: the description mentions 'an attacker' obtaining the key via AJAX, which on default WordPress could imply unauthenticated nonce-only access, but the CVSS vector explicitly encodes PR:L - so this analysis treats it as requiring a low-privileged authenticated session (e.g., subscriber), and defenders should confirm with the Wordfence advisory whether open registration is a precondition.

An attacker registers a low-privilege account on a target WordPress site running WishList Member 3.30.1 or earlier (or uses any existing subscriber-level credentials), then issues an authenticated AJAX request to the export_settings action and reads the plugin's REST API Secret Key from the JSON response. Using that key, they call the WishList Member REST API to create a new membership level mapped to the WordPress 'administrator' role and provision an attacker-controlled user into it, yielding full site takeover within minutes.