Description

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a temporary or incomplete registrant that is bound to the current registration transaction. This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by supplying an arbitrary user's numeric ID as the mergewith value, which causes wp_update_user() to overwrite the target account's username (additionally written via a direct $wpdb UPDATE), password, email address, first name, and last name with attacker-controlled values, while WordPress password and email change notification emails are explicitly suppressed. When wpm_id references a non-existent membership level, no role key is added to the update payload, causing wp_update_user() to preserve the target user's existing role — including administrator — making full privilege escalation a direct consequence of the takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-14T06:16:53.237Z",
  "pubdate": "2026-08-14T06:16:53.237Z",
  "executiveSummary": "The Wishlist Member plugin for WordPress in versions up to and including 3.34.1 suffers from an Account Takeover vulnerability caused by insufficient verification of data authenticity.\nThis flaw allows unauthenticated attackers to completely compromise arbitrary WordPress user accounts, including high-privileged administrator accounts, leading to full site compromise.\nThe vulnerability arises within the registration and account merging logic, where critical POST parameters are accepted and processed without cryptographically binding them to the active registration transaction validated by the registration cookie.\nAttackers can exploit this remotely over the network without requiring any prior authentication or special privileges.\nSuccessful exploitation results in the modification of critical account attributes—such as usernames, passwords, and email addresses—while explicitly suppressing standard WordPress security notification emails to maintain stealth.\nAdditionally, targeting a non-existent membership level preserves the existing role of the victim, ensuring that compromised administrator accounts retain their elevated privileges post-exploitation.",
  "technicalDetails": "The vulnerability resides in the wpm_register() function of the Wishlist Member plugin, affecting versions up to and including 3.34.1. The root cause is the lack of proper validation and data authenticity verification regarding the registration transaction state.\nDuring the registration flow, the function validates the registration cookie solely against the GET reg parameter. However, it concurrently accepts user-supplied input via the POST mergewith and POST wpm_id parameters.\nThe application fails to verify whether the user ID supplied in the mergewith parameter references a temporary or incomplete registrant that is cryptographically or logically bound to the active registration session.\nAttackers can leverage this architectural oversight through the following step-by-step attack flow: First, the attacker initiates or interacts with the registration mechanism. Second, the attacker crafts an HTTP POST request targeting the vulnerable endpoint, supplying an arbitrary target user's numeric ID in the mergewith parameter.\nBecause the input is processed without adequate checks, the application passes the data directly to wp_update_user() and executes a direct database modification via a $wpdb UPDATE statement.\nThis payload execution forces the application to overwrite the target user's core profile data, including the username, password, email address, first name, and last name, with attacker-controlled values.\nTo evade detection, the application explicitly suppresses standard WordPress password change and email change notification emails.\nFurthermore, if the wpm_id parameter references a non-existent membership level, no role key is included in the update payload. As a result, wp_update_user() preserves the target user's pre-existing role, making full privilege escalation an immediate consequence when targeting administrator accounts.\nThe vulnerability is exploitable remotely over the network by unauthenticated attackers with zero initial privileges."
}