Loading vulnerability…
Privilege Escalation in WishList Member WordPress Plugin export_settings
CVE-2026-6895 affects the WishList Member plugin for WordPress in versions up to and including 3.30.1. The vulnerability is caused by missing capability checks in the plugin's export_settings function, resulting in a missing authorization flaw. By invoking the vulnerable functionality, an attacker can obtain the plugin's REST API Secret Key from an AJAX JSON response. With that secret key, the attacker can authenticate to the WishList Member API, create a new membership level mapped to the WordPress administrator role, and then register an arbitrary administrator-level user account. The issue therefore combines sensitive information disclosure with privilege escalation and can lead to full compromise of the affected WordPress site.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged attacker to disclose the WishList Member REST API Secret Key, abuse the plugin API, create a membership level associated with the administrator role, and register an arbitrary administrator account. This results in privilege escalation to full administrative control of the WordPress site and effectively complete site takeover, with corresponding high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to the affected plugin functionality as much as possible, minimize exposure of vulnerable WordPress instances, and monitor for suspicious requests to the vulnerable AJAX endpoint and for unauthorized creation of membership levels or administrator accounts. Rotate the WishList Member REST API Secret Key if compromise is suspected and audit WordPress users and plugin configuration for persistence.
Patch, then assume compromise.
Upgrade the WishList Member plugin to a version newer than 3.30.1 that fixes the missing capability checks in the export_settings function. Validate that the updated version no longer exposes the REST API Secret Key through the affected AJAX response and review existing membership levels and administrator accounts for unauthorized changes created through exploitation.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.