CVE-2026-6419: WishList Member Privilege Escalation Flaw

CVE-2026-6419 Overview

The WishList Member plugin for WordPress contains a privilege escalation flaw in versions up to and including 3.30.1. The ajax_get_screen() function lacks both capability and nonce checks. Authenticated attackers with Subscriber-level access can supply an arbitrary admin screen identifier through the data[url] parameter. The plugin then renders the administrative API configuration template without authorization. The response leaks the plaintext REST API Secret Key directly to the attacker. An attacker who obtains this key can authenticate to the WishList Member API, create a membership level mapped to the administrator WordPress role, and register an arbitrary administrator account. This results in complete site takeover and maps to Missing Authorization [CWE-269].

Critical Impact

Authenticated Subscriber-level users can escalate privileges to administrator and achieve full WordPress site takeover.

Affected Products

• WishList Member WordPress plugin versions up to and including 3.30.1
• WordPress sites with Subscriber-or-higher account registration enabled
• All WordPress installations running the vulnerable plugin in default configuration

Discovery Timeline

• 2026-05-23 - CVE-2026-6419 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-6419

Vulnerability Analysis

The vulnerability resides in the ajax_get_screen() AJAX handler exposed by the WishList Member plugin. The handler accepts a screen identifier via the data[url] parameter and loads the corresponding admin screen template. The handler omits both a capability check and a WordPress nonce verification. Any authenticated user, including a Subscriber, can therefore invoke administrative screen rendering through the admin-ajax.php endpoint.

When the attacker supplies the identifier for the administrative API configuration screen, the plugin renders the template server-side and returns the resulting HTML in the AJAX JSON response. That template embeds the plaintext REST API Secret Key used to authenticate to the WishList Member REST API.

With the Secret Key, the attacker calls the plugin's REST API to create a new membership level bound to the WordPress administrator role. The attacker then registers a new user assigned to that level. The newly created account holds full administrator privileges, enabling plugin installation, theme editing, and arbitrary PHP execution on the host.

Root Cause

The root cause is Missing Authorization [CWE-269] in ajax_get_screen(). The function does not call current_user_can() to verify administrative capability and does not validate a nonce using check_ajax_referer(). Sensitive configuration data is also returned directly in the AJAX response rather than restricted to authorized rendering contexts.

Attack Vector

The attack requires only network access and a low-privileged authenticated session. The attacker sends a POST request to wp-admin/admin-ajax.php with the plugin's AJAX action and the targeted admin screen identifier in data[url]. The server returns the rendered administrative template containing the REST API Secret Key. The attacker then issues authenticated REST API calls to create the administrator-level membership and user account.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-6419

Indicators of Compromise

• POST requests to wp-admin/admin-ajax.php referencing the WishList Member ajax_get_screen action originating from Subscriber-level accounts.
• AJAX responses containing wlm_secret_key or REST API key strings returned to non-administrative sessions.
• Creation of new membership levels bound to the WordPress administrator role via the WishList Member REST API.
• Unexpected administrator user accounts created shortly after AJAX activity from low-privileged users.

Detection Strategies

• Inspect web server access logs for admin-ajax.php calls invoking WishList Member screen-loading actions from sessions without manage_options capability.
• Correlate AJAX request bursts containing the data[url] parameter with subsequent REST API calls to WishList Member endpoints.
• Monitor the WordPress users and usermeta tables for new accounts with the administrator role created outside change windows.

Monitoring Recommendations

• Alert on any creation of WordPress users with the administrator role from REST API contexts.
• Track plugin REST API authentication events and flag use of the WishList Member Secret Key from unfamiliar IP addresses.
• Enable WordPress audit logging to capture role changes, membership-level creation, and option modifications.

How to Mitigate CVE-2026-6419

Immediate Actions Required

• Update the WishList Member plugin to a version above 3.30.1 as soon as a patched release is available from the vendor.
• Audit all WordPress administrator accounts and remove any unrecognized users.
• Rotate the WishList Member REST API Secret Key after patching to invalidate any key copied by attackers.
• Restrict new user registration to trusted workflows until the plugin is patched.

Patch Information

Review the vendor advisory at the WishList Member Official Site for the fixed release. The Wordfence Vulnerability Report tracks the affected version range and remediation status.

Workarounds

• Disable the WishList Member plugin until a patched version is installed if business operations allow.
• Block external access to wp-admin/admin-ajax.php requests carrying the vulnerable action using a web application firewall rule.
• Temporarily disable open user registration to prevent attackers from obtaining Subscriber-level accounts.
• Restrict REST API access to the WishList Member endpoints by IP allowlist at the WAF or reverse proxy layer.

# Example WAF rule concept: block low-privileged calls to the vulnerable AJAX action
# (Adapt to your WAF syntax; verify action name in plugin source before deployment)
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026419,msg:'Block WishList Member ajax_get_screen abuse (CVE-2026-6419)'"
SecRule ARGS:action "@streq wlm_ajax_get_screen" \
  "chain"
SecRule ARGS:data[url] "@rx .+" "t:none"