CVE-2026-24575: WishList Member X Auth Bypass Flaw

CVE-2026-24575 Overview

CVE-2026-24575 is a broken access control vulnerability in the WishList Member X WordPress plugin affecting versions 3.29.0 and earlier. The plugin fails to enforce proper authorization checks, allowing authenticated users at the Subscriber role to access functionality reserved for higher-privileged accounts. The flaw is classified under [CWE-862] Missing Authorization. An attacker requires only low-privilege authentication and no user interaction to exploit the issue over the network. Successful exploitation results in unauthorized disclosure of plugin-managed data without affecting integrity or availability.

Critical Impact
Authenticated subscribers can bypass authorization controls in WishList Member X to access restricted plugin functionality and disclose membership-related information.

Affected Products

WishList Member X WordPress plugin versions <= 3.29.0
WordPress sites running the vulnerable plugin with open subscriber registration
Membership sites relying on WishList Member X for access gating

Discovery Timeline

2026-06-17 - CVE-2026-24575 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-24575

Vulnerability Analysis

The vulnerability stems from missing authorization checks in one or more plugin endpoints exposed by WishList Member X. The plugin registers actions that should be limited to administrators or other elevated roles but accepts requests from any authenticated WordPress user. A Subscriber, the lowest authenticated WordPress role, can invoke these endpoints directly. The flaw maps to [CWE-862] Missing Authorization and produces a confidentiality impact without affecting data integrity or service availability. The Patchstack advisory categorizes the issue as a Subscriber+ broken access control vulnerability.

Root Cause

The root cause is the absence of capability checks such as current_user_can() on protected plugin handlers. WordPress plugins must validate both the user role and request nonce before processing privileged actions. WishList Member X verifies authentication but does not enforce role-based authorization on the affected endpoints. Any logged-in account, including self-registered subscribers, satisfies the authentication gate and reaches the privileged code path.

Attack Vector

An attacker first obtains a Subscriber account on the target WordPress site, either through open registration or membership signup flows that WishList Member X itself provides. The attacker then issues authenticated HTTP requests to the vulnerable plugin endpoint. Because no capability check rejects the request, the plugin returns data or performs actions that should be restricted to administrators. The attack requires network access to the WordPress site and the low-privilege session cookie. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2026-24575

Indicators of Compromise

Authenticated requests from Subscriber-role accounts to administrative WishList Member X endpoints under /wp-admin/admin-ajax.php or /wp-json/
Newly registered Subscriber accounts followed by access patterns targeting plugin-specific actions
Unexpected reads of membership data, level configuration, or subscriber lists by low-privilege sessions

Detection Strategies

Inspect WordPress access logs for action= parameters tied to WishList Member X handlers originating from non-administrative users
Correlate user role metadata with HTTP request paths to flag privilege mismatches
Apply web application firewall rules that block Subscriber-role sessions from reaching plugin admin endpoints

Monitoring Recommendations

Forward WordPress audit logs and PHP access logs to a centralized SIEM for role-versus-endpoint correlation
Alert on bursts of authenticated requests from accounts created within the last 24 hours
Track installed plugin versions across managed WordPress fleets to identify hosts running WishList Member X <= 3.29.0

How to Mitigate CVE-2026-24575

Immediate Actions Required

Update WishList Member X to a version later than 3.29.0 once the vendor publishes a fixed release
Disable open user registration on sites that do not require it by unsetting Anyone can register in WordPress General Settings
Audit existing Subscriber accounts and remove unrecognized users created during the exposure window

Patch Information

Refer to the Patchstack Vulnerability Report for the current patched version and vendor remediation guidance. Apply the vendor-supplied update through the WordPress plugin manager or by replacing plugin files manually.

Workarounds

Deploy a virtual patch through Patchstack or another WordPress-aware WAF to block requests to the vulnerable endpoints from non-administrator sessions
Restrict access to /wp-admin/admin-ajax.php and REST API plugin namespaces using server-level access controls where feasible
Temporarily deactivate WishList Member X if membership functionality is non-critical until the patch is applied

bash

# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0
wp user list --role=subscriber --field=ID --format=ids