CVE-2026-25446: WishList Member X Path Traversal Flaw

CVE-2026-25446 Overview

CVE-2026-25446 is an arbitrary file upload vulnerability in the WishList Member X WordPress plugin versions 3.29.0 and earlier. The flaw allows authenticated users with subscriber-level privileges to upload files of arbitrary types to the WordPress server. Successful exploitation can lead to remote code execution by uploading PHP web shells or other executable content. The vulnerability is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type. Patchstack published the advisory documenting the issue in the plugin's file handling logic.

Critical Impact
Authenticated subscribers can upload arbitrary files, including executable PHP, resulting in full WordPress site compromise and remote code execution.

Affected Products

WishList Member X plugin for WordPress, versions <= 3.29.0
WordPress installations using WishList Member X for membership management
Sites permitting open subscriber registration with the plugin enabled

Discovery Timeline

2026-06-17 - CVE-2026-25446 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-25446

Vulnerability Analysis

The vulnerability stems from missing or insufficient validation of file types during upload operations exposed by the WishList Member X plugin. A user authenticated at the subscriber role, the lowest privilege tier in WordPress, can invoke upload endpoints that should be restricted to administrators or content editors. Because the plugin does not enforce extension allowlisting, MIME validation, or capability checks adequate to the operation, an attacker can submit PHP, .phtml, or other server-executable files.

Once a malicious file lands inside the web root, the attacker requests it directly to execute arbitrary code in the context of the web server user. This converts a low-privilege account into full code execution on the WordPress host. The scope change reflected in the advisory indicates impact extends beyond the vulnerable component to the underlying site.

Root Cause

The root cause is unrestricted file upload [CWE-434]. The plugin trusts client-supplied filenames and content types without server-side verification. Capability checks tied to the upload handler are insufficient, granting subscribers access to functionality that should require upload_files or higher permissions.

Attack Vector

Exploitation requires network access to the WordPress site and a valid subscriber account, which is trivial to obtain on sites that allow self-registration. The attacker authenticates, sends a crafted multipart request to the vulnerable plugin endpoint, and retrieves the uploaded payload from its public URL. No user interaction from administrators is required. Refer to the Patchstack Vulnerability Report for additional context.

Verified proof-of-concept code is not publicly available at this time.
See the Patchstack advisory referenced above for technical details.

Detection Methods for CVE-2026-25446

Indicators of Compromise

Unexpected files with executable extensions such as .php, .phtml, or .phar inside wp-content/uploads/ or plugin-managed upload directories
HTTP POST requests from subscriber accounts to WishList Member X upload endpoints followed by GET requests to newly created files
New or modified WordPress user accounts with the subscriber role created shortly before suspicious upload activity

Detection Strategies

Review web server access logs for multipart/form-data POST requests targeting WishList Member X endpoints originating from low-privilege sessions
File integrity monitoring on the wp-content/uploads/ tree to flag creation of script-executable file types
Static scanning of uploaded files for PHP tags, eval constructs, or known web shell signatures

Monitoring Recommendations

Forward WordPress audit logs and web server logs to a central SIEM and alert on subscriber-initiated uploads
Monitor outbound network connections from the web server process, which often indicate post-exploitation command-and-control activity
Track plugin version inventory across WordPress estates to identify hosts still running WishList Member X <= 3.29.0

How to Mitigate CVE-2026-25446

Immediate Actions Required

Update WishList Member X to a version later than 3.29.0 that addresses the file upload flaw
Audit the wp-content/uploads/ directory and plugin-managed paths for unauthorized executable files and remove any found
Review and remove unknown subscriber accounts, then rotate credentials for legitimate users

Patch Information

Apply the vendor-supplied update referenced in the Patchstack Vulnerability Report. Upgrade through the WordPress plugin manager or via WP-CLI to ensure the fixed release is deployed across all sites.

Workarounds

Disable the WishList Member X plugin until patching is complete on production sites
Disable open user registration by setting Anyone can register to off in WordPress general settings
Block execution of PHP within upload directories using web server configuration to prevent dropped shells from running

bash

# Apache: prevent PHP execution in WordPress uploads
cat > /var/www/html/wp-content/uploads/.htaccess <<'EOF'
<FilesMatch "\.(php|phtml|phar|php5|php7)$">
    Require all denied
</FilesMatch>
EOF

# Nginx: add to server block
# location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
#     deny all;
#     return 403;
# }

# Update plugin via WP-CLI
wp plugin update wishlist-member-x