# CVE-2026-24575: WishList Member WishList Member X broken access control

Source: https://junglewise.ai/threats/cve-2026-24575-wishlist-member-wishlist-member-x-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-17  
License: CC BY 4.0 with a link back

CVE-2026-24575 · Severity: medium · CVSS 4.3 · Published 2026-06-17

WishList Member X is a WordPress plugin used to manage memberships and restrict access to content. A security flaw allows users with basic 'Subscriber' accounts to bypass certain access controls, potentially viewing information they are not authorized to see. This could lead to unauthorized access to member-only content or internal site data.

Technologies: [WishList Member](https://junglewise.ai/threats/technologies/wishlist-member). Vendors: [WishList Member](https://junglewise.ai/threats/vendors/wishlist-member).

## Quick answers

**Is CVE-2026-24575 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24575 being exploited in the wild.

**How severe is CVE-2026-24575?** Medium severity, with a CVSS score of 4.3, published 17 June 2026.

**Which products and versions are affected?** WishList Member <= 3.29.0.

**Is there a fix for CVE-2026-24575?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24575 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-24575?** Check whether you run WishList Member at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in WishList Member X versions up to and including 3.29.0. The issue stems from missing authorization checks (CWE-862) within the plugin's functions. An authenticated attacker with Subscriber-level privileges can exploit this over the network to perform actions or access data that should be restricted to higher-privileged roles. As of the advisory date, no official patch has been confirmed, though users are advised to monitor for updates from the vendor.

## Affected products

- WishList Member WishList Member X <= 3.29.0

## Timeline

- 2025-12-21: other: Reported by researcher 0xd4rk5id3
- 2026-01-20: disclosed: Initial disclosure by Patchstack
- 2026-06-17: advisory: NVD publication date

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wishlist-member-x/vulnerability/wordpress-wishlist-member-x-plugin-3-29-0-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wishlist-member-x/vulnerability/wordpress-wishlist-member-x-plugin-3-29-0-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [WishList Member WordPress plugin privilege escalation](https://junglewise.ai/threats/cve-2026-6898-wishlist-member-wordpress-plugin-privilege-escalation)
- [WishList Member privilege escalation in Team_Accounts](https://junglewise.ai/threats/cve-2026-6897-wishlist-member-privilege-escalation-in-team-accounts)
- [WishList Member privilege escalation in export_settings](https://junglewise.ai/threats/cve-2026-6895-wishlist-member-privilege-escalation-in-export-settings)