CVE-2026-6897: Wishlist Member Auth Bypass Vulnerability

CVE-2026-6897 Overview

CVE-2026-6897 is a privilege escalation vulnerability in the Wishlist Member plugin for WordPress. The flaw exists in all versions up to and including 3.30.1. A missing capability check on the WishListMember\Features\Team_Accounts::save_settings function lets authenticated users with Subscriber-level access modify arbitrary plugin options. Attackers can overwrite the REST API Secret Key, create a membership level mapped to the administrator role, and register an administrator-level account. The result is full site takeover from a low-privilege account. The vulnerability is categorized under [CWE-269] Improper Privilege Management.

Critical Impact
Subscriber-level accounts can escalate to WordPress administrator and achieve complete site takeover through arbitrary plugin option modification.

Affected Products

Wishlist Member plugin for WordPress, all versions up to and including 3.30.1
WordPress sites with membership functionality powered by Wishlist Member
Sites permitting Subscriber-level registration are at highest exposure

Discovery Timeline

2026-05-23 - CVE-2026-6897 published to the National Vulnerability Database
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-6897

Vulnerability Analysis

The Wishlist Member plugin exposes the Team_Accounts::save_settings function without verifying the caller's capabilities. WordPress AJAX and REST endpoints typically require an explicit current_user_can() check to gate administrative actions. This handler omits that check, so any authenticated session, including Subscriber accounts, can invoke it.

Once invoked, the function writes attacker-controlled values into the plugin's option store. The plugin's REST API Secret Key is one of the writable options. Overwriting the secret grants the attacker authenticated access to plugin REST endpoints that manage membership levels and user provisioning.

The attacker then creates a membership level that maps registered users to the WordPress administrator role. Registering through that membership level produces a new administrator account, completing the escalation from Subscriber to full site control. The CWE-269 classification reflects the broken privilege boundary inside the plugin.

Root Cause

The root cause is a missing authorization check on a settings-writing function. The plugin trusts authentication alone and fails to verify whether the caller holds the manage_options capability before persisting plugin configuration changes.

Attack Vector

Exploitation occurs over the network against any reachable WordPress site running the vulnerable plugin. The attacker authenticates with any account at Subscriber level or higher, then sends a request to the unprotected settings handler. Sites that allow open user registration reduce the attack to a fully remote, low-skill operation. No user interaction from administrators is required.

A full exploitation chain consists of three logical steps: (1) call save_settings to overwrite the REST API Secret Key, (2) use that key to create a membership level bound to the administrator role, and (3) register a user account assigned to that level. Each step abuses legitimate plugin functionality after the authorization boundary is bypassed.

Detection Methods for CVE-2026-6897

Indicators of Compromise

Unexpected changes to Wishlist Member plugin options, particularly the REST API Secret Key value
Creation of new membership levels mapped to the administrator WordPress role
New WordPress user accounts with administrator role created shortly after Subscriber-level registration or login events
Authenticated requests to Wishlist Member settings endpoints originating from Subscriber accounts

Detection Strategies

Audit the wp_options table for recent modifications to Wishlist Member configuration keys and compare against known-good values
Review wp_users and wp_usermeta for administrator accounts created outside scheduled provisioning windows
Inspect web server access logs for POST requests to Wishlist Member AJAX or REST endpoints from low-privilege session cookies
Correlate plugin option changes with the originating user ID to identify non-administrator actors writing settings

Monitoring Recommendations

Enable WordPress audit logging for user role changes, option updates, and membership level creation
Alert on any creation of a WordPress administrator account, regardless of source
Monitor for replays of the Wishlist Member REST API Secret Key from new IP addresses after configuration changes
Track the rate of Subscriber-level registrations against subsequent privileged actions on the same session

How to Mitigate CVE-2026-6897

Immediate Actions Required

Update the Wishlist Member plugin to a version later than 3.30.1 as soon as the vendor publishes a fixed release
Disable open user registration on affected WordPress sites until the plugin is patched
Rotate the Wishlist Member REST API Secret Key and review all membership level role assignments
Audit administrator accounts and remove any that cannot be attributed to a known administrator

Patch Information

The vendor has been notified through the Wordfence disclosure process. Refer to the Wordfence Vulnerability Report and the Wishlist Member site for the current fixed version. Sites should apply the patched release through the WordPress plugin updater once available and verify the installed version exceeds 3.30.1.

Workarounds

Restrict access to /wp-admin/admin-ajax.php and Wishlist Member REST routes via a web application firewall rule blocking Subscriber-level callers from save_settings
Temporarily deactivate the Wishlist Member plugin if membership functionality is not business-critical
Lock new user registrations to require manual administrator approval before role assignment
Enforce strong, monitored review of any newly created administrator accounts until the patch is applied

bash

# Example WAF rule sketch: block Subscriber-level POSTs to the vulnerable action
# Adjust to your WAF syntax; intent is to deny the action for non-admin sessions
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,deny,status:403,id:1026897,msg:'Block Wishlist Member save_settings from low-priv users'"
  SecRule ARGS:action "@streq wlm_save_settings" \
    "chain"
    SecRule REQUEST_COOKIES:/wordpress_logged_in_/ "@rx .+"