Executive Summary

CVE-2026-24575 is a Broken Access Control vulnerability in the WordPress WishList Member X Plugin, versions 3.29.0 and below.

This vulnerability allows unprivileged users, such as those with a Subscriber role, to perform actions that normally require higher privileges because the plugin lacks proper authorization checks.

It is classified under OWASP Top 10 A1: Broken Access Control and has a low severity rating with a CVSS score of 4.3.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow users with low-level permissions (like Subscribers) to perform actions that should be restricted to higher privilege users.

Although the risk of exploitation is considered low, it could lead to unauthorized access or changes within the WordPress site using the WishList Member X plugin.

Immediate action is recommended to mitigate potential risks, such as updating the plugin or seeking help from a hosting provider or developer.

Useful 0 Not Useful 0

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the WishList Member X plugin to a version above 3.29.0 once available.

Since no official patch is currently available, it is recommended to seek assistance from your hosting provider or a developer to implement temporary access control measures.

Because the vulnerability allows unprivileged users to perform higher privilege actions, restricting subscriber role permissions or disabling the plugin temporarily may reduce risk.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the Broken Access Control vulnerability in WishList Member X affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0