The Wishlist Member plugin for WordPress contains a missing capability check in the function that generates its API secret key for all versions up to 3.30.1. This allows any authenticated user with a Subscriber role or higher to alter the REST API secret key. By updating the key, an attacker can create a new membership level that grants the WordPress administrator role or register a new user account with full administrative privileges, resulting in a complete takeover of the site.

WordPress sites that have the Wishlist Member plugin installed and are running version 3.30.1 or earlier. Sites are vulnerable when the plugin is active and users can authenticate as Subscriber or higher.

The vulnerability is rated with a CVSS score of 8.8, indicating high severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an authenticated attacker who has access to a Subscriber or higher level account. The attacker can trigger the AJAX endpoint ‘wlm3_generate_api_key’ to change the API secret key, then create an administrator-level membership or register an admin user, thereby gaining full site control.