Executive brief
WishList Member is a popular WordPress plugin used to manage memberships, courses, and protected content. A security flaw allows any logged-in user, even those with basic 'Subscriber' permissions, to trick the plugin into revealing its secret API key. An attacker can use this key to grant themselves administrative control over the entire website, leading to a complete site takeover and potential theft of member data.
Technical details
The WishList Member plugin for WordPress (up to version 3.30.1) is vulnerable to privilege escalation via missing authorization and nonce checks in the ajax_get_screen() function. Authenticated attackers with Subscriber-level access or higher can exploit this by providing an arbitrary admin screen identifier through the 'data[url]' parameter. This causes the plugin to execute and render administrative API configuration templates. The resulting AJAX response contains the plugin's plaintext REST API Secret Key. With this key, an attacker can authenticate to the WishList Member API, create a new membership level with the WordPress 'administrator' role, and register a new admin account, leading to full site compromise.
Affected products
- WishList Products WishList Member up to and including 3.30.1
Timeline
- 2026-05-23: disclosed: Vulnerability disclosed by Wordfence and published to NVD.