EUVD-2026-31523
GHSA-pxfc-4432-7mrc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconRegister Subscriber account on target site
-
DeliveryAuthenticate to WordPress
-
ExploitCall generate_api_key endpoint to overwrite plugin secret
-
InstallCreate membership level mapped to administrator role
-
C2Register new user assigned to that level
-
ExecuteLog in as administrator
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must hold a valid WordPress account of Subscriber role or higher on the target site - typically satisfied by self-registration on any site running Wishlist Member, since the plugin's primary use case is letting visitors sign up for membership tiers. The target must be running Wishlist Member 3.30.1 or earlier with the plugin active, and the WordPress REST/AJAX endpoint serving the generate_api_key hook must be network-reachable. Exploitation is limited where the site administrator has disabled public user registration, enforces email verification before activating accounts, or fronts wp-admin/wp-json with IP restrictions or a WAF; no user interaction by an admin is required, and no special platform or PHP configuration is needed. |
| Impact | The CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) accurately reflects a network-reachable, low-complexity bug that yields full confidentiality, integrity and availability impact, gated only by a Subscriber account - trivially obtainable on any site with open registration, which is the default for membership plugins. The vulnerability is not present in CISA KEV and no EPSS score is provided, but Wordfence-disclosed WordPress privilege-escalation bugs in widely deployed plugins are routinely incorporated into automated mass-scanning toolkits within days. The PR:L scoring is the only meaningful brake on real-world risk; sites that disable user registration or restrict it via CAPTCHA/email verification raise the bar materially. No POC link is present in the supplied references, so POC availability is unknown - treat as imminent rather than confirmed weaponized. |
| Exploit ScenarioDerived | An attacker registers a free Subscriber account on a site running Wishlist Member ≤3.30.1, authenticates, and sends a single request to the generate_api_key handler to overwrite the plugin's REST API Secret Key with one they control. They then call the plugin's REST API with that key to create a new membership level mapped to the WordPress administrator role and register a new user assigned to it, logging in as a full administrator and taking over the site. No public exploit identified at time of analysis, but the attack is fully scriptable and requires no user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 23, 2026
Privilege escalation in the Wishlist Member WordPress plugin (versions ≤3.30.1) allows authenticated Subscriber-level users to overwrite the plugin's REST API Secret Key and abuse it to create administrator accounts, leading to full site takeover. The flaw stems from a missing capability check on the generate_api_key hook handler. No public exploit identified at time of analysis, though Wordfence has published a threat-intel advisory.
RemediationAI
No vendor-released patched version is identified in the supplied data; consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/05ce62ce-a02f-431e-95b1-ade38988e3ad?source=cve and the vendor at https://wishlistmember.com/ for a fixed release above 3.30.1 and update immediately when available. Until a patched build is installed, disable open user registration in WordPress (Settings → General → uncheck 'Anyone can register'), which closes the Subscriber-acquisition path but breaks the plugin's own signup flow for free tiers; alternatively, place the WordPress admin and plugin REST endpoints behind a WAF rule or IP allow-list and audit wp_users and wishlist membership levels for unexpected administrator entries. Rotate any plugin-managed REST API Secret Key after patching and force-reset passwords for accounts created during the exposure window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Wishlist Member is a commercial membership/paywall plugin for WordPress used to gate content behind subscription tiers. The vulnerability lives in WishListMember3_Hooks::generate_api_key, an AJAX/REST endpoint that regenerates the plugin's internal REST API Secret Key but omits a current_user_can() capability check. This maps to CWE-269 (Improper Privilege Management): the function relies on nonce/auth presence rather than role validation, so any logged-in user - including the lowest WordPress role, Subscriber - can invoke it. Once the secret is attacker-controlled, the plugin's own REST surface honors it for creating membership levels (which the plugin can map onto WordPress roles, including administrator) and provisioning users assigned to those levels.
Know when Wishlist Member gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember3_Hooks::generate_api_key' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.
Executive ViewAI
The Wishlist Member WordPress plugin (versions 3.30.1 and earlier) contains a privilege escalation vulnerability enabling unauthorized administrative access to the website, exposing organizations to data theft, service disruption, and reputational damage. All WordPress sites using this plugin face immediate risk and require urgent remediation to prevent loss of administrative control.
No vendor-released patch identified at time of analysis. Interim mitigations: disable Wishlist Member plugin entirely if business operations permit; restrict user registration and audit existing accounts for suspicious activity; disable REST API endpoints if not required; implement comprehensive security logging and alerting for new administrator account creation; review and strengthen access controls on Subscriber-level roles; monitor vendor announcements daily for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in WishList Member Plugin Missing Authorization Flaws
View all 4More in Wishlist Member
View allUnauthenticated account takeover in the Wishlist Member WordPress membership plugin (versions up to and including 3.34.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Softwar
Improper Control of Generation of Code ('Code Injection') vulnerability in Membership Software WishList Member X allows
Broken access control in WishList Member X WordPress plugin (versions ≤ 3.29.0) permits authenticated subscriber-level u
Exploit-DB