Wishlist Member EUVD-2026-58589

Exploitation requires that the Wishlist Member plugin (version ≤ 3.34.1) is installed and its registration workflow is reachable - the attacker must reach the wpm_register() handler and obtain a registration cookie tied to a GET 'reg' value, then supply attacker-controlled POST 'mergewith' (the victim's numeric user ID, e.g. an administrator) and POST 'wpm_id' set to a non-existent membership level to preserve the victim's role. No authentication or user interaction is needed (PR:N/UI:N), consistent with the CVSS vector. The main limiting factor is that a site must have the plugin active with a registration flow enabled; sites that disable Wishlist Member self-registration or restrict access to the registration endpoint are not exploitable through this path.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) is internally consistent with the description: exploitation is remote, unauthenticated, low-complexity, and requires no user interaction, yielding full compromise of any account. No EPSS score, KEV listing, or POC reference is present in the input, so real-world exploitation cannot be confirmed - this assessment rests on the vector and description rather than observed activity. There is no signal conflict: the network/no-privilege vector matches an unauthenticated HTTP POST attack. The absence of EPSS/KEV data means likelihood of active exploitation is currently UNKNOWN, but the combination of trivial exploitability, administrator takeover, and a widely distributed plugin makes this a genuine high priority rather than an inflated high-CVSS-but-low-impact case; treat as urgent pending patch confirmation.

An unauthenticated attacker initiates a registration to obtain a valid registration cookie, then submits a crafted POST to the registration handler setting mergewith to the numeric ID of the site administrator (commonly user ID 1) and wpm_id to a non-existent membership level. The plugin overwrites the administrator's username, password, and email with the attacker's values while preserving the administrator role and suppressing notification emails, giving the attacker silent full control of the site. No public POC is identified at time of analysis, but the low complexity and unauthenticated network vector make exploitation straightforward to develop.