CVE-2026-12949
Received Received - Intake

Account Takeover in Wishlist Member WordPress Plugin

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: Wordfence

Description
The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a temporary or incomplete registrant that is bound to the current registration transaction. This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by supplying an arbitrary user's numeric ID as the mergewith value, which causes wp_update_user() to overwrite the target account's username (additionally written via a direct $wpdb UPDATE), password, email address, first name, and last name with attacker-controlled values, while WordPress password and email change notification emails are explicitly suppressed. When wpm_id references a non-existent membership level, no role key is added to the update payload, causing wp_update_user() to preserve the target user's existing role — including administrator — making full privilege escalation a direct consequence of the takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-12949
EUVD
EUVD-2026-58589

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wishlist_member wishlist_member to 3.34.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Wishlist Member WordPress plugin has a flaw where attackers can take over any account, including admin accounts, by manipulating registration parameters. The plugin fails to properly verify user data during registration, allowing unauthenticated attackers to overwrite account details like usernames, passwords, and emails by supplying arbitrary user IDs. This leads to full account compromise and privilege escalation.

Detection Guidance

Check WordPress sites using Wishlist Member plugin versions up to 3.34.1. Inspect server logs for suspicious registration attempts or account modifications. Look for POST requests to wpm_register with mergewith and wpm_id parameters. Monitor for unauthorized changes to user accounts, especially administrators.

Impact Analysis

If you use the Wishlist Member plugin, attackers could gain full control of your WordPress site, including admin accounts. They could steal sensitive data, modify content, or lock you out. The vulnerability affects all versions up to 3.34.1, so updating is critical to prevent exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access control. A successful takeover may result in data breaches, non-compliance penalties, and loss of trust due to compromised user information.

Mitigation Strategies

Immediately update Wishlist Member plugin to the latest version. Disable the plugin if an update is unavailable. Review user accounts for unauthorized changes. Implement strong password policies and enable two-factor authentication. Monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12949. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart