Missing Authorization Vulnerability in WishList Member Plugin for WordPress

CVE-2026-6895

What is CVE-2026-6895?

The WishList Member plugin for WordPress has a vulnerability that allows attackers to exploit the 'export_settings' AJAX function, which lacks adequate capability checks. This flaw results in sensitive information disclosure, as it exposes the REST API Secret Key within the AJAX JSON response. With access to this key, an attacker is able to authenticate against the WishList Member API, potentially leading to privilege escalation by creating new membership levels tied to the administrator role and registering arbitrary users with administrator-level privileges. This could result in a complete takeover of the affected WordPress site.

References