CVE-2026-12949 – Unauthenticated Account Takeover / Privilege Escalation – Wishlist Member WordPress

Summary

CVE-2026-12949 is a critical, unauthenticated account takeover vulnerability in the Wishlist Member WordPress membership plugin, affecting all versions up to and including 3.34.1. The flaw stems from insufficient verification of data authenticity in the plugin’s registration handling logic, allowing an unauthenticated attacker to hijack any WordPress account — including administrator accounts — and, in certain conditions, escalate privileges to full site administrator. The issue carries a CVSS v3.1 base score of 9.8 (Critical).

Technical details

• Root cause: The plugin’s wpm_register() function validates the registration cookie only against the GET reg parameter, while the POST mergewith and wpm_id parameters — which control which existing WordPress user account is merged with/claimed by the registration flow — are accepted without verifying that the requester is actually authorized to act on that account.
• Trigger conditions: An attacker sends a crafted registration request that supplies an arbitrary target wpm_id/mergewith value; because these values are not cryptographically bound to the validated registration cookie, the plugin will merge the attacker-controlled registration into an existing account of the attacker’s choosing.
• Attack vector: Network-based, unauthenticated (AV:N, PR:N, UI:N) — no valid credentials, prior session, or user interaction are required to exploit the flaw.
• Impact: Successful exploitation lets an attacker take over any account, including administrator profiles, by changing the target account’s username, password, email address, and display name, while suppressing the associated notification emails so the legitimate owner is not alerted. When the request references a non-existent membership level, the compromised account’s existing administrative WordPress role is left intact, resulting in privilege escalation and full site takeover on WordPress installations running the vulnerable plugin.

Affected software

• Wishlist Member (WordPress plugin) — all versions up to and including 3.34.1

Severity

• CVSS v3.1 Base Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

• Immediate: At the time of publication, the CVE record does not identify a confirmed patched release beyond 3.34.1. Site owners should check the Wishlist Member vendor site and plugin changelog directly for a security update addressing this issue and apply it as soon as it becomes available.
• If no patch is available:
  • Restrict or monitor access to the plugin’s registration endpoint (wpm_register action) at the WAF/reverse-proxy layer, blocking requests that include unexpected mergewith/wpm_id POST parameters on unauthenticated registration submissions.
  • Audit WordPress user accounts — especially administrator-level accounts — for unexpected changes to usernames, email addresses, or passwords, and for suppressed/missing account-change notification emails.
  • Enforce multi-factor authentication on all administrator accounts to limit the impact of a successful account takeover.
  • Consider temporarily disabling the Wishlist Member registration/merge feature or taking the plugin offline on internet-facing sites until an official fix is confirmed and applied.
  • Continuously monitor vendor communications for the release of a patched version and apply it immediately upon availability.

References

• CVE-2026-12949 Record (CVE Program)
• Wordfence Threat Intelligence Advisory
• Wishlist Member Official Website