Unauthorized Data Modification in Wishlist Member Plugin for WordPress

CVE-2026-6898

What is CVE-2026-6898?

The Wishlist Member plugin for WordPress is exposed to a security flaw that enables authenticated users with Subscriber-level permissions and above to modify the REST API Secret Key without proper checks. This vulnerability arises due to the absence of a capability verification in the 'WishListMember3_Hooks::generate_api_key' function, allowing potential attackers to escalate their privileges. By exploiting this weakness, attackers could create new membership levels assigned the WordPress administrator role or register unauthorized administrator-level user accounts, leading to a potential complete takeover of the affected site.

References