The Wishlist Member plugin for WordPress contains a missing capability check in the WishListMember\Features\Team_Accounts::save_settings function, allowing any authenticated user with the Subscriber role or higher to call the wishlistmember_team_accounts_save_settings AJAX endpoint and arbitrarily modify plugin options. This flaw permits changing sensitive configuration values, such as the REST API secret key, creating new membership levels with administrator privileges, or registering arbitrary administrator‑level accounts, effectively granting full control of the site.

All installations of the Wishlist Member plugin for WordPress up to and including version 3.30.1 are vulnerable. Any WordPress site using these versions is at risk when an authenticated user with a Subscriber‑level role or higher exists.

With a CVSS score of 8.8 the vulnerability is high severity. Although the EPSS score is unavailable, the lack of an access control check means that an attacker only needs legitimate credentials of a Subscriber or higher. The fact that the flaw is exploitable via a standard AJAX call makes it relatively easy for threat actors with valid accounts to elevate privileges and compromise the entire site, and the vulnerability is not listed in CISA KEV. The high likelihood of exploitation arises from the common presence of Subscriber accounts on WordPress sites and the ease of performing the malicious requests.