What is the CVSS score of CVE-2026-6898?

CVE-2026-6898 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Wishlist Member are affected by CVE-2026-6898?

The Wishlist Member WordPress plugin (versions 3.30.1 and earlier) contains a privilege escalation vulnerability enabling unauthorized administrative access to the website, exposing organizations to…

How to fix or mitigate CVE-2026-6898?

Within 24 hours: inventory all WordPress installations to identify systems running Wishlist Member versions 3.30.1 and earlier. Within 7 days: disable the plugin on all affected systems, rotate all administrator credentials, audit user accounts and REST API activity for unauthorized changes, and review logs for suspicious account creation. Within 30 days: monitor vendor advisories weekly for patched versions before re-enabling the plugin.

Wishlist Member CVE-2026-6898

EUVD-2026-31523 HIGH

Improper Privilege Management (CWE-269)

2026-05-23 Wordfence

GHSA-pxfc-4432-7mrc

WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 23, 2026 - 05:15 vuln.today

DescriptionCVE.org

The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember3_Hooks::generate_api_key' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.

AnalysisAI

Privilege escalation in the Wishlist Member WordPress plugin (versions ≤3.30.1) allows authenticated Subscriber-level users to overwrite the plugin's REST API Secret Key and abuse it to create administrator accounts, leading to full site takeover. The flaw stems from a missing capability check on the generate_api_key hook handler. No public exploit identified at time of analysis, though Wordfence has published a threat-intel advisory.

Technical ContextAI

Wishlist Member is a commercial membership/paywall plugin for WordPress used to gate content behind subscription tiers. The vulnerability lives in WishListMember3_Hooks::generate_api_key, an AJAX/REST endpoint that regenerates the plugin's internal REST API Secret Key but omits a current_user_can() capability check. This maps to CWE-269 (Improper Privilege Management): the function relies on nonce/auth presence rather than role validation, so any logged-in user - including the lowest WordPress role, Subscriber - can invoke it. Once the secret is attacker-controlled, the plugin's own REST surface honors it for creating membership levels (which the plugin can map onto WordPress roles, including administrator) and provisioning users assigned to those levels.

RemediationAI

No vendor-released patched version is identified in the supplied data; consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/05ce62ce-a02f-431e-95b1-ade38988e3ad?source=cve and the vendor at https://wishlistmember.com/ for a fixed release above 3.30.1 and update immediately when available. Until a patched build is installed, disable open user registration in WordPress (Settings → General → uncheck 'Anyone can register'), which closes the Subscriber-acquisition path but breaks the plugin's own signup flow for free tiers; alternatively, place the WordPress admin and plugin REST endpoints behind a WAF rule or IP allow-list and audit wp_users and wishlist membership levels for unexpected administrator entries. Rotate any plugin-managed REST API Secret Key after patching and force-reset passwords for accounts created during the exposure window.