# CVE-2026-6419: WishList Member privilege escalation in ajax_get_screen

Source: https://junglewise.ai/threats/cve-2026-6419-wishlist-member-privilege-escalation-in-ajax-get-screen  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-23. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-6419 · Severity: high · CVSS 8.8 · Published 2026-05-23

WishList Member is a popular WordPress plugin used to manage memberships, courses, and protected content. A security flaw allows any logged-in user, even those with basic 'Subscriber' permissions, to trick the plugin into revealing its secret API key. An attacker can use this key to grant themselves administrative control over the entire website, leading to a complete site takeover and potential theft of member data.

## Quick answers

**Is CVE-2026-6419 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6419 being exploited in the wild.

**How severe is CVE-2026-6419?** High severity, with a CVSS score of 8.8, published 23 May 2026.

**Which products and versions are affected?** WishList Products WishList Member up to and including 3.30.1.

**Is there a fix for CVE-2026-6419?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6419 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6419?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WishList Member plugin for WordPress (up to version 3.30.1) is vulnerable to privilege escalation via missing authorization and nonce checks in the ajax_get_screen() function. Authenticated attackers with Subscriber-level access or higher can exploit this by providing an arbitrary admin screen identifier through the 'data[url]' parameter. This causes the plugin to execute and render administrative API configuration templates. The resulting AJAX response contains the plugin's plaintext REST API Secret Key. With this key, an attacker can authenticate to the WishList Member API, create a new membership level with the WordPress 'administrator' role, and register a new admin account, leading to full site compromise.

## Affected products

- WishList Products WishList Member up to and including 3.30.1

## Timeline

- 2026-05-23: disclosed: Vulnerability disclosed by Wordfence and published to NVD.

## References

- [https://wishlistmember.com/](https://wishlistmember.com/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ff0ff4-0878-4e9e-8082-e0f6effef92c?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ff0ff4-0878-4e9e-8082-e0f6effef92c?source=cve)