The WishList Member plugin for WordPress is vulnerable to Privilege Escalation via Missing Authorization in…

CVE-2026-6419 affects the WishList Member WordPress plugin in versions up to and including 3.30.1; authoritative third-party advisories list 3.31.0 as patched. The flaw sits in the ajax_get_screen() path behind wp-admin/admin-ajax.php: a logged-in Subscriber+ user can supply an arbitrary data[url] value, make the plugin render an administrative API configuration screen, and receive HTML containing the plugin's plaintext REST API secret key. With that key, the attacker can use the WishList Member API to create an admin-mapped membership level and then register an arbitrary administrator account.

paragraphs

Why this verdict

• Downward pressure: requires authenticated access — baseline vendor score is 8.8, but the first prerequisite is a live WordPress account with at least Subscriber rights. That means the bug is *not* a cold internet edge exploit and should be scored below unauthenticated takeover flaws.
• Upward pressure: product context weakens the auth friction — this is a membership plugin, so low-privilege user accounts are often the normal business model, not a rare insider foothold. On many affected sites, an attacker does not need prior host compromise; they may only need to sign up or buy the cheapest account tier.
• Downward pressure: no current exploitation signal — the prompt's EPSS is 0.00044, the CVE is not in KEV, and I found no primary-source evidence of active campaigns. That argues against emergency-at-scale treatment even though the impact is full site takeover.
• Upward pressure: blast radius is full application compromise — once the secret key is exposed, the chain leads to administrator account creation and standard WordPress persistence. For the affected site, this is not cosmetic misconfiguration; it is a complete trust-boundary failure.
• Downward pressure: exposure is narrower than generic WordPress plugin bugs — WishList Member is a premium, more specialized plugin and the vulnerable path sits behind authenticated admin-ajax.php usage. That lowers opportunistic mass-scanning efficiency compared with easily fingerprinted public endpoints.

Why not higher?

This is not unauthenticated remote code execution and not a one-packet internet-edge compromise. The chain depends on an authenticated Subscriber+ session and a working WishList Member API path, which removes a large share of opportunistic attacker population and slows mass exploitation.

Why not lower?

Calling this MEDIUM would ignore the fact that the end state is full administrator takeover with straightforward, low-complexity exploitation once logged in. For membership sites where subscriber creation is part of normal business, the access prerequisite is often a speed bump, not a moat.

1. Upgrade WishList Member to 3.31.0 or later — This is the clean fix and should be your first control. For a HIGH verdict, complete this within 30 days at the latest, and faster on any internet-facing membership property with self-registration enabled.
2. Disable or tightly gate self-registration — Reduce the cheapest path into the exploit chain by turning off open registration where business permits, or requiring payment approval, invite-only onboarding, stronger CAPTCHA, and MFA. Apply this compensating control within 30 days if patching cannot happen immediately.
3. Block suspicious wlm3_get_screen AJAX requests — Use your WAF or reverse proxy to inspect POSTs to /wp-admin/admin-ajax.php and deny action=wlm3_get_screen from low-privilege or anonymous contexts where possible. Deploy within 30 days as an interim shield for lagging sites.
4. Rotate the WishList Member API secret after patching — If the key may already have been exposed, patching alone does not invalidate a stolen credential. Rotate the secret and review API consumers within 30 days, immediately for any site showing suspicious AJAX or API activity.
5. Hunt for post-exploit artifacts — Review for newly created administrator accounts, new membership levels mapped to administrator, unexpected plugin installs, and calls to /wp-json/wlm3/. Do this within 30 days across all affected sites because the most likely attacker objective is durable site takeover.

Run this on the target WordPress host or a mounted backup of the web root. Invoke it as bash check-cve-2026-6419.sh /var/www/html with read access to the WordPress installation; no root is required unless filesystem permissions demand it.

#!/usr/bin/env bash
# check-cve-2026-6419.sh
# Detects whether WishList Member appears vulnerable to CVE-2026-6419 based on installed version.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE

set -u

TARGET_VERSION="3.30.1"

usage() {
  echo "Usage: $0 /path/to/wordpress"
  exit 3
}

verlte() {
  # returns 0 if $1 <= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

extract_version() {
  local plugin_dir="$1"
  local v=""

  # Try common metadata files first
  if [ -f "$plugin_dir/readme.txt" ]; then
    v=$(grep -iE '^Stable tag:' "$plugin_dir/readme.txt" | head -n1 | sed -E 's/^Stable tag:[[:space:]]*//I' | tr -d '\r')
    if [ -n "$v" ] && [[ "$v" =~ ^[0-9]+(\.[0-9]+)+$ ]]; then
      echo "$v"
      return 0
    fi
  fi

  # Search top-level PHP files for a plugin header Version field
  while IFS= read -r -d '' f; do
    v=$(head -n 80 "$f" | grep -iE '^\s*Version:' | head -n1 | sed -E 's/^\s*Version:[[:space:]]*//I' | tr -d '\r')
    if [ -n "$v" ] && [[ "$v" =~ ^[0-9]+(\.[0-9]+)+$ ]]; then
      echo "$v"
      return 0
    fi
  done < <(find "$plugin_dir" -maxdepth 1 -type f -name '*.php' -print0 2>/dev/null)

  return 1
}

[ $# -eq 1 ] || usage
WP_ROOT="$1"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/wishlist-member-x"

if [ ! -d "$WP_ROOT" ]; then
  echo "UNKNOWN: WordPress path does not exist: $WP_ROOT"
  exit 2
fi

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "UNKNOWN: WishList Member plugin directory not found at $PLUGIN_DIR"
  exit 2
fi

VERSION=$(extract_version "$PLUGIN_DIR") || true

if [ -z "${VERSION:-}" ]; then
  echo "UNKNOWN: Could not determine WishList Member version from $PLUGIN_DIR"
  exit 2
fi

if verlte "$VERSION" "$TARGET_VERSION"; then
  echo "VULNERABLE: WishList Member version $VERSION <= $TARGET_VERSION"
  exit 1
else
  echo "PATCHED: WishList Member version $VERSION > $TARGET_VERSION"
  exit 0
fi

Sources

1. NVD CVE-2026-6419
2. Patchstack advisory for CVE-2026-6419
3. Wordfence WishList Member vulnerability page with recent CVEs
4. WishList Member changelog index
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation
7. Atomic Edge PoC and WAF rule for CVE-2026-6419
8. WishList Member version support policy