WishList Member registration permits unauthenticated administrator takeover
WishList Member through 3.34.1 permits unauthenticated account takeover in wpm_register(). The registration flow validates its cookie only against the reg transaction value, but accepts separate mergewith and wpm_id POST values without binding the target account to that transaction. An attacker can select an existing numeric user ID and cause wp_update_user() plus a direct database update to replace that account's username, password, email and name. Selecting a nonexistent membership level avoids changing the existing WordPress role, allowing an administrator account to remain an administrator after its credentials are replaced.
- Component
- Wishlist Member
- Plugin slug
wishlist-member- Affected
- <= 3.34.1
- Safe version
- See mitigation notes
- Published
- Aug 14, 2026
This CVE was published Aug 14, 2026 and is one of 6 known issues for this plugin.
Update, patch or deactivate.
No fixed release is identified. Deactivate or remove the plugin when the site's risk warrants until the vendor supplies a confirmed patch. Audit administrator and member-profile changes, rotate compromised credentials, and invalidate all suspicious sessions.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a temporary or incomplete registrant that is bound to the current registration transaction. This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by supplying an arbitrary user's numeric ID as the mergewith value, which causes wp_update_user() to overwrite the target account's username (additionally written via a direct $wpdb UPDATE), password, email address, first name, and last name with attacker-controlled values, while WordPress password and email change notification emails are explicitly suppressed. When wpm_id references a non-existent membership level, no role key is added to the update payload, causing wp_update_user() to preserve the target user's existing role — including administrator — making full privilege escalation a direct consequence of the takeover.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H