Loading story…
A critical vulnerability tracked as CVE-2026-12949 allows unauthenticated attackers to take over existing accounts in the Wishlist Member WordPress plugin, including administrator accounts. The flaw affects versions up to and including 3.34.1 and stems from improper validation in the plugin's wpm_register() flow, where the reg value is checked but attacker-controlled mergewith and wpm_id inputs are still accepted. By supplying an arbitrary user ID in mergewith, an attacker can overwrite a victim account's username, password, email address, and profile details while suppressing WordPress password and email change notifications.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
The CVE entry for the Wishlist Member unauthenticated account takeover vulnerability was published, documenting the root cause in wpm_register() and the risk of administrator account takeover. The record also listed a CVSS 9.8 severity and recommended updating the plugin.
The critical Wishlist Member vulnerability was publicly disclosed, with details showing that attackers could abuse the mergewith parameter to take over existing WordPress accounts, including administrators. The flaw was described as remotely exploitable without authentication.
The identifier CVE-2026-12949 was reserved for the Wishlist Member WordPress plugin vulnerability. This reservation preceded the later public disclosure of the issue.
Attack attempts targeting CVE-2026-12949 were observed in the wild, and Wordfence reportedly blocked those attacks. At the time of reporting, successful compromises had not been confirmed.
Wishlist Member version 3.34.2 was identified as the version that fixes the unauthenticated account takeover flaw affecting versions up to and including 3.34.1. The remediation guidance recommended updating to 3.34.2 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple high-severity flaws in popular WordPress membership plugins can let attackers create administrator accounts and fully compromise affected sites. In the **User Registration & Membership** plugin, `CVE-2026-1492` affects versions through `5.1.2` and allows **unauthenticated** attackers to bypass authentication by abusing exposed nonce values, weak server-side validation, and legitimate AJAX functionality in membership workflows, including requests to `admin-ajax.php`. Researchers said successful exploitation can lead to malicious plugin installation, persistence, data theft, site defacement, and potential remote code execution; the issue is fixed in version `5.1.3`, and public exploit code is available. A separate cluster of vulnerabilities affects **WishList Member** through version `3.30.1`, where several missing authorization checks let **Subscriber-level or higher** users escalate privileges. `CVE-2026-6895` and `CVE-2026-6419` can expose the plugin's REST API Secret Key through AJAX actions, while `CVE-2026-6898` and `CVE-2026-6897` allow authenticated users to generate or modify that key and other plugin settings. With the API key, an attacker can create a membership level mapped to the WordPress administrator role, register a new admin account, and take over the site, extending a pattern of recurring authentication-bypass and privilege-escalation weaknesses previously seen in related membership plugin codebases.
Jun 29, 2026
Multiple high-severity flaws in WordPress plugins exposed sites to account takeover and, in one case, possible remote code execution. In **Users Manager PN**, tracked as `CVE-2026-4003`, a missing authorization check in the `userspn_ajax_nopriv_server()` handler let unauthenticated attackers overwrite arbitrary user metadata through the `userspn_form_save` AJAX action. Because the required `userspn-nonce` was reportedly exposed on public pages, attackers could abuse the bug with a single crafted request to modify profiles and potentially seize control of administrator accounts. The issue affected versions through `1.1.15` and was reportedly fixed in `1.1.20`. Two additional vulnerabilities were disclosed in **WP Captcha PRO** affecting versions through `5.38`. `CVE-2026-5415` allowed **Subscriber-level users or higher** to generate temporary login links for arbitrary accounts because the `ajax_run_tool()` AJAX handler checked only a nonce and not user capabilities, enabling authentication bypass and administrator takeover. Separately, `CVE-2026-5411` allowed authenticated low-privilege users to upload attacker-controlled files by poisoning license metadata and abusing `sync_cloud_protection()` to download and extract content into a web-accessible uploads directory; if PHP execution was possible and `allow_url_fopen` was enabled for remote retrieval, the flaw could be escalated to **remote code execution** via a webshell.
Jun 29, 2026
A critical unauthenticated privilege-escalation flaw, **CVE-2026-75816** (CVSS 9.8), affects the Frontend Admin by DynamiApps WordPress plugin, distributed under the `acf-frontend-form-element` slug. The vulnerability affects versions through **3.29.12** and stems from missing capability checks and an authorization bypass when non-numeric user or post identifiers are supplied. An unauthenticated attacker can alter arbitrary users’ email addresses, then invoke WordPress’s password-reset process to seize an administrator account and fully compromise the affected site. DynamiApps remediated the issue in version **3.29.13**; administrators should update immediately and review user email changes and password-reset activity. No active exploitation was reported at publication.
Sep 6, 2026