CVE-2026-6898: Wishlist Member Auth Bypass Vulnerability

CVE-2026-6898 Overview

The Wishlist Member plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 3.30.1. The flaw stems from a missing capability check on the WishListMember3_Hooks::generate_api_key function. Authenticated attackers with Subscriber-level access or higher can update the REST API Secret Key. Once the key is controlled, attackers create a new membership level mapped to the WordPress administrator role and register an arbitrary administrator account. The result is complete site takeover. The vulnerability is classified under CWE-269: Improper Privilege Management.

Critical Impact
Any authenticated Subscriber can escalate to full administrator privileges and take over the affected WordPress site.

Affected Products

Wishlist Member plugin for WordPress, all versions through 3.30.1
WordPress sites using membership functionality provided by Wishlist Member
Sites permitting user self-registration at Subscriber level or above

Discovery Timeline

2026-05-23 - CVE-2026-6898 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-6898

Vulnerability Analysis

The vulnerability resides in the WishListMember3_Hooks::generate_api_key function. The function regenerates the plugin's REST API Secret Key but does not verify whether the requesting user holds an administrative capability. Because WordPress AJAX and hook endpoints are routinely exposed to any authenticated user, the missing current_user_can() check exposes a privileged administrative action to low-privilege accounts.

The REST API Secret Key is the trust anchor for Wishlist Member's REST endpoints. Once an attacker rotates and obtains this key, they can call membership-management endpoints as a trusted client. Those endpoints allow creation of membership levels mapped to WordPress roles, including administrator, and registration of new user accounts assigned to those levels. The chain converts a Subscriber session into full administrative control of the site.

Root Cause

The root cause is improper privilege management [CWE-269]. The generate_api_key handler lacks a capability check and nonce validation sufficient to restrict execution to administrators. WordPress relies on plugin authors to gate sensitive functions with current_user_can('manage_options') or equivalent. The absence of that gate exposes API key generation to any logged-in user.

Attack Vector

The attack vector is network-based and requires only low-privilege authentication. On sites where open registration is enabled, attackers register a Subscriber account themselves. The attacker then invokes the vulnerable handler to overwrite the REST API Secret Key. Using the new key, the attacker calls Wishlist Member REST endpoints to create an administrator-level membership and a new user assigned to it. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-6898

Indicators of Compromise

Unexpected changes to the Wishlist Member REST API Secret Key value stored in WordPress options
Creation of new membership levels mapped to the WordPress administrator role
New WordPress user accounts with administrator privileges that were not provisioned by site staff
HTTP requests to Wishlist Member AJAX or hook endpoints invoking generate_api_key from Subscriber sessions

Detection Strategies

Audit the wp_users and wp_usermeta tables for newly added accounts with the administrator capability
Review WordPress options tables for modifications to Wishlist Member configuration entries, particularly the REST API secret
Inspect web server access logs for POST requests targeting Wishlist Member admin-ajax or hook handlers from low-privilege sessions
Correlate user registration events with subsequent membership-level creation events occurring in short time windows

Monitoring Recommendations

Enable WordPress audit logging for user role changes, plugin option modifications, and membership configuration changes
Forward WordPress and web server logs to a centralized SIEM for correlation across authentication and configuration events
Alert on any administrator account creation that does not originate from an existing administrator session
Monitor for outbound calls to Wishlist Member REST endpoints originating from unusual IP addresses or user agents

How to Mitigate CVE-2026-6898

Immediate Actions Required

Update the Wishlist Member plugin to a version newer than 3.30.1 once the vendor releases a patched build
Audit all WordPress administrator accounts and remove any that cannot be attributed to legitimate staff
Rotate the Wishlist Member REST API Secret Key and any associated integration credentials
Disable open user self-registration if it is not required for site operation

Patch Information

At the time of publication, the vendor advisory references the Wishlist Member product page and the Wordfence Vulnerability Report. Administrators should consult the vendor for the fixed release version and apply it across all affected sites. Verify the patched build adds a capability check to WishListMember3_Hooks::generate_api_key before deployment.

Workarounds

Restrict access to the WordPress admin-ajax endpoint by IP allowlisting through a web application firewall where feasible
Temporarily disable the Wishlist Member plugin on sites that allow Subscriber-level registration until a patch is applied
Set the WordPress users_can_register option to false to prevent unauthenticated account creation
Apply WAF rules that block requests invoking the generate_api_key action from non-administrator sessions

bash

# Disable open registration via WP-CLI
wp option update users_can_register 0

# Deactivate the vulnerable plugin until patched
wp plugin deactivate wishlist-member

# List all administrator accounts for review
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered