What is the CVSS score of CVE-2026-6897?

CVE-2026-6897 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Wishlist Member are affected by CVE-2026-6897?

Wishlist Member WordPress plugin (versions through 3.30.1) allows user-level account holders to escalate privileges to site administrators, enabling complete control over WordPress installations.

How to fix or mitigate CVE-2026-6897?

Within 24 hours: Disable public user registration and deactivate Wishlist Member plugin on all affected WordPress installations. Within 7 days: Review WordPress administrative account logs and plugin modification records for evidence of unauthorized access; document any suspicious activity. Within 30 days: Deploy alternative membership plugin with vendor security assurances; complete full site security assessment; reset all user and administrator passwords; audit database for unauthorized changes.

Wishlist Member CVE-2026-6897

EUVD-2026-31525 HIGH

Improper Privilege Management (CWE-269)

2026-05-23 Wordfence

GHSA-wgj9-7jrr-37h9

WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 23, 2026 - 05:16 vuln.today

DescriptionCVE.org

The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\Features\Team_Accounts::save_settings' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options, includes the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.

AnalysisAI

Privilege escalation in the Wishlist Member WordPress plugin (versions through 3.30.1) allows any authenticated user with Subscriber-level access or higher to update arbitrary plugin options, including the REST API Secret Key, leading to full site takeover. The flaw stems from a missing capability check in the Team_Accounts::save_settings function, and although no public exploit identified at time of analysis, the low authentication bar and chained admin-account creation path make it a high-priority risk on any WordPress site that permits public registration.

Technical ContextAI

Wishlist Member is a commercial WordPress membership plugin used to gate content and manage subscription tiers. The vulnerable code path is WishListMember\Features\Team_Accounts::save_settings, which writes to plugin option storage without invoking WordPress's current_user_can() capability check - the classic CWE-269 (Improper Privilege Management) pattern in WordPress plugins where a nonce or login check is performed but the role/capability check is omitted. Because plugin options include the REST API Secret Key, the broken authorization in one settings handler transitively breaks authentication for the plugin's REST endpoints, which in turn can create membership levels mapped to the WordPress administrator role. The affected CPE is cpe:2.3:a:wishlist_member:wishlist_member:*:*:*:*:*:*:*:* across all versions up to and including 3.30.1.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data - the Wordfence advisory should be consulted at https://www.wordfence.com/threat-intel/vulnerabilities/id/db251792-cbad-41e1-aaca-4cd39a25b444?source=cve for the fixed version once published, and the plugin should be upgraded to any release above 3.30.1 as soon as one is available. Until a patched version is installed, disable open user registration in WordPress (Settings → General → uncheck 'Anyone can register') to remove the Subscriber-account prerequisite, audit existing Subscriber and higher accounts for unfamiliar entries, rotate the Wishlist Member REST API Secret Key after patching, and consider temporarily deactivating the plugin if the site does not actively need it - accepting that this will gate paid members out until reactivation. A WAF rule blocking unauthenticated and low-privileged POSTs to the Team_Accounts save_settings handler is a reasonable virtual patch with minimal side effects.