WORDPRESS · AUGUST 2026 · EARLY WARNING

Wishlist Member WordPress Plugin Vulnerable to Account Takeover

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
CRITICAL
CVSS
9.8
Affected component
wishlist member plugin (wordpress)
Patched version
Not yet available
CVE-2026-12949

The Wishlist Member plugin for WordPress is reportedly vulnerable to Account Takeover via Insufficient Verification of Data Authenticity. This affects versions up to and including 3.34.1.

What happened

The vulnerability, tracked as CVE-2026-12949, allows unauthenticated attackers to take over any existing WordPress account, including administrator accounts, by supplying an arbitrary user's numeric ID. This is due to insufficient verification of data authenticity in the wpm_register() function. The issue lies in the validation of the registration cookie only against the GET reg parameter, while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a temporary or incomplete registrant that is bound to the current registration transaction.

This vulnerability enables attackers to overwrite the target account's username, password, email address, first name, and last name with attacker-controlled values. The wp_update_user() function is exploited to perform these changes, which are additionally written via a direct $wpdb UPDATE.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If wishlist member plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using the Wishlist Member plugin for WordPress in versions up to and including 3.34.1.

What should I do right now?

Upgrade the Wishlist Member plugin to a version beyond 3.34.1 and review all accounts for unauthorized changes.

Is there an official fix available?

No official fix has been published yet. Monitor the primary sources for updates.

Sources

Join the 0Day waitlist →

← Back to all threats