What is the CVSS score of CVE-2026-6895?

CVE-2026-6895 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WishList Member are affected by CVE-2026-6895?

WishList Member WordPress plugin (versions ≤3.30.1) contains a privilege escalation vulnerability enabling low-privilege site users to extract REST API credentials and create unauthorized…

How to fix or mitigate CVE-2026-6895?

Within 24 hours: identify and audit all WordPress installations running WishList Member plugin versions ≤3.30.1; immediately disable the plugin on affected sites. Within 7 days: forensically review WordPress user account creation logs and REST API access for unauthorized administrator accounts; revoke any suspicious accounts and reset credentials for legitimate administrators. Within 30 days: monitor WishList Member vendor advisories for patch availability; evaluate and migrate to alternative membership plugin solutions.

WishList Member CVE-2026-6895

EUVD-2026-31526 HIGH

Improper Privilege Management (CWE-269)

2026-05-23 Wordfence

GHSA-7f9p-fmh2-r992

WordPress Privilege Escalation Information Disclosure Wishlist Member

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 23, 2026 - 05:15 vuln.today

DescriptionCVE.org

The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation in versions up to and including 3.30.1. This is due to the missing capability checks in the 'export_settings' function. This function returns the REST API Secret Key to the attacker in the AJAX JSON response. An attacker who obtains this key can authenticate to the WishList Member API, create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.

AnalysisAI

Privilege escalation in the WishList Member WordPress plugin versions up to 3.30.1 allows authenticated low-privilege users to obtain the REST API Secret Key via the unprotected 'export_settings' AJAX endpoint and leverage it to register arbitrary administrator accounts. The CVSS 8.8 (High) rating reflects full confidentiality, integrity, and availability impact, and while no public exploit is identified at time of analysis, the discovery by Wordfence - a major WordPress security vendor - typically precedes broader exploitation against the large WordPress plugin ecosystem.

Technical ContextAI

WishList Member is a popular WordPress membership plugin that exposes administrative configuration through admin-ajax.php handlers. The root cause is CWE-269 (Improper Privilege Management): the 'export_settings' AJAX handler omits the required WordPress capability check (e.g., current_user_can('manage_options')) before returning the plugin's REST API Secret Key in its JSON response. Because the plugin's own REST API trusts this secret for high-privilege operations such as creating membership levels mapped to WordPress roles, leaking it through an under-protected AJAX endpoint effectively bridges a low-privileged WordPress session into administrative control of the plugin's API surface, and through the role-assignment feature, into the WordPress site itself.

RemediationAI

Upgrade WishList Member to a version newer than 3.30.1 - the input data does not name an exact fixed version, so released patched version not independently confirmed; check the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5b313e3d-61e0-496e-af3b-155666fae059?source=cve and the vendor site https://wishlistmember.com/ for the current patched build before deploying. Until the patched version is installed, restrict access to /wp-admin/admin-ajax.php?action=export_settings (and any plugin-specific REST routes that consume the Secret Key) at the web server or WAF, rotate the WishList Member REST API Secret Key on every site after upgrade in case it has already been exfiltrated, audit administrator accounts and membership levels for unexpected entries created since plugin installation, and consider temporarily disabling open user registration if it is enabled - with the trade-off that this will block legitimate self-service signups on membership sites.