Description
The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a temporary or incomplete registrant that is bound to the current registration transaction. This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by supplying an arbitrary user's numeric ID as the mergewith value, which causes wp_update_user() to overwrite the target account's username (additionally written via a direct $wpdb UPDATE), password, email address, first name, and last name with attacker-controlled values, while WordPress password and email change notification emails are explicitly suppressed. When wpm_id references a non-existent membership level, no role key is added to the update payload, causing wp_update_user() to preserve the target user's existing role — including administrator — making full privilege escalation a direct consequence of the takeover.
Published: 2026-08-14
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Wishlist Member plugin up to version 3.34.1 contains a flaw in the wpm_register() function that only verifies the registration cookie against a GET parameter while accepting POST parameters mergewith and wpm_id without proper validation. An unauthenticated attacker can supply any numeric user ID as mergewith, causing WordPress to update that user’s credentials and personal details, suppressing notification emails. If wpm_id refers to a non‑existent membership level, the existing role, including administrator, remains unchanged, giving the attacker full privileges.

Affected Systems

WordPress sites that use the Wishlist Member plugin in version 3.34.1 or earlier are directly affected. No other vendors or products are listed as impacted.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity. While an EPSS score is not available, the vulnerability requires only an unauthenticated HTTP request, making it potentially exploitable by widespread automation. It is not currently listed in CISA KEV, but the attack vector is clear: a crafted request to the plugin’s registration endpoint can result in complete account takeover and privilege escalation.

Generated by OpenCVE AI on August 14, 2026 at 06:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Wishlist Member plugin to a version newer than 3.34.1 or apply any available vendor patch that closes the identified registration flaw.
  • Restrict external access to the plugin’s registration endpoint, for example by limiting the URL to trusted hosts or by implementing a web application firewall rule that blocks requests containing arbitrary mergewith or wpm_id parameters.
  • Ensure that all user‑update operations in the site enforce proper authentication and authorization checks so that only legitimate, logged‑in administrators can modify existing accounts.

Generated by OpenCVE AI on August 14, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Wishlist Member
Wishlist Member wishlist Member
Wordpress
Wordpress wordpress
Vendors & Products Wishlist Member
Wishlist Member wishlist Member
Wordpress
Wordpress wordpress

Fri, 14 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Description The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a temporary or incomplete registrant that is bound to the current registration transaction. This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by supplying an arbitrary user's numeric ID as the mergewith value, which causes wp_update_user() to overwrite the target account's username (additionally written via a direct $wpdb UPDATE), password, email address, first name, and last name with attacker-controlled values, while WordPress password and email change notification emails are explicitly suppressed. When wpm_id references a non-existent membership level, no role key is added to the update payload, causing wp_update_user() to preserve the target user's existing role — including administrator — making full privilege escalation a direct consequence of the takeover.
Title Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter
Weaknesses CWE-640
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Wishlist Member Wishlist Member
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-14T05:30:43.982Z

Reserved: 2026-06-22T20:38:06.650Z

Link: CVE-2026-12949

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-14T06:16:53.237

Modified: 2026-08-14T06:16:53.237

Link: CVE-2026-12949

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T06:30:03Z

Weaknesses
  • CWE-640

    Weak Password Recovery Mechanism for Forgotten Password