Wishlist Member CVE-2026-6897

Exploitation requires (1) an authenticated WordPress account at Subscriber level or above on the target site, and (2) the Wishlist Member plugin installed and active at version 3.30.1 or earlier with the Team Accounts feature reachable. The realistic limiting factor is account acquisition: sites that disable open registration force the attacker to obtain credentials by other means (phishing, credential stuffing, paid membership signup), while membership-driven sites - the plugin's core audience - typically allow self-registration and so effectively reduce the prerequisite to zero. No user interaction by an admin is needed, and no non-default plugin configuration is required beyond having the vulnerable Team_Accounts code path enabled.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with full CIA impact - appropriate for a privilege-escalation-to-takeover chain. The PR:L requirement is meaningful: the attacker must already hold a Subscriber account, but on the many WordPress sites that allow open registration (or whose entire purpose is membership signup, as is typical for sites running Wishlist Member), that prerequisite is essentially free. There is no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis, so exploitation appears opportunistic rather than confirmed widespread; however, the vendor advisory was published by Wordfence, whose disclosures are routinely converted into automated exploitation by WordPress-targeting botnets within days. Net assessment: treat as a real priority, not a paper tiger.

An attacker registers a free Subscriber account on a Wishlist Member-protected site (or uses any existing low-privileged credential), then sends an authenticated request to the Team_Accounts save_settings handler to overwrite the plugin's REST API Secret Key with a value of their choosing. Using that secret, they call the plugin's REST API to create a new membership level mapped to the WordPress administrator role and register a new user assigned to it, gaining full admin access to install backdoors, exfiltrate data, or pivot to the hosting environment.