Privilege Escalation in WishList Member Plugin for WordPress

CVE-2026-6419

What is CVE-2026-6419?

The WishList Member plugin for WordPress is susceptible to a vulnerability that enables privilege escalation due to inadequate authorization checks in the ajax_get_screen() function. This flaw allows authenticated users with Subscriber-level access or higher to manipulate the plugin into loading administrative API configurations without proper credentials. By exploiting this vulnerability, attackers can access sensitive information, including the plaintext REST API Secret Key. With this key, unauthorized users can interact with the WishList Member API to create new high-privilege user accounts, potentially leading to complete control over the site.

References