PT-2026-42863 · WordPress · Wishlist Member
H0Xilo
·
Published
2026-05-23
·
Updated
2026-05-25
·
CVE-2026-6419
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
WishList Member versions prior to 3.30.2
Description
An issue exists where missing authorization allows for privilege escalation. The
ajax get screen() function fails to perform necessary capability and nonce checks. Authenticated attackers with Subscriber-level access or higher can provide an arbitrary admin screen identifier through the data[url] parameter. This action causes the plugin to load and execute the administrative API configuration template without authorization, returning the plugin's plaintext REST API Secret Key within the AJAX JSON response. An attacker possessing this key can authenticate to the API, create a membership level with the administrator WordPress role, and register an administrator-level user account, leading to a complete site takeover.Recommendations
Update to a version later than 3.30.1.
As a temporary workaround, restrict access to the
ajax get screen() function to prevent unauthorized users from triggering the administrative API configuration template.Fix
LPE
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wishlist Member