WordPress Membership Plugin Flaws Enable Administrator Account Takeover

Multiple high-severity flaws in popular WordPress membership plugins can let attackers create administrator accounts and fully compromise affected sites. In the User Registration & Membership plugin, CVE-2026-1492 affects versions through 5.1.2 and allows unauthenticated attackers to bypass authentication by abusing exposed nonce values, weak server-side validation, and legitimate AJAX functionality in membership workflows, including requests to admin-ajax.php. Researchers said successful exploitation can lead to malicious plugin installation, persistence, data theft, site defacement, and potential remote code execution; the issue is fixed in version 5.1.3, and public exploit code is available.

A separate cluster of vulnerabilities affects WishList Member through version 3.30.1, where several missing authorization checks let Subscriber-level or higher users escalate privileges. CVE-2026-6895 and CVE-2026-6419 can expose the plugin's REST API Secret Key through AJAX actions, while CVE-2026-6898 and CVE-2026-6897 allow authenticated users to generate or modify that key and other plugin settings. With the API key, an attacker can create a membership level mapped to the WordPress administrator role, register a new admin account, and take over the site, extending a pattern of recurring authentication-bypass and privilege-escalation weaknesses previously seen in related membership plugin codebases.