CVE-2026-12949: Unauthenticated Account Takeover in Wishlist Member Plugin

The Wishlist Member plugin for WordPress (versions 3.34.1 and below) is susceptible to a critical account takeover vulnerability (CVE-2026-12949) caused by insufficient verification of data authenticity within the wpm_register() function. Attackers can exploit this flaw by submitting specific POST parameters (mergewith and wpm_id) to the registration endpoint. The plugin fails to verify if the mergewith parameter, which accepts a numeric WordPress user ID, is cryptographically bound to the current registration transaction.

By supplying an arbitrary user ID, an attacker can force the application to execute wp_update_user() and a direct $wpdb UPDATE, overwriting the victim's credentials, email, and name. Critically, the plugin suppresses WordPress's built-in notification emails for password or email address changes. If the wpm_id parameter is set to a non-existent membership level, the plugin skips the role update, preserving the target user's existing permissions. This allows unauthenticated attackers to silently elevate their access to an administrator level, posing a significant risk to site integrity and data security.

Attack Chain

1. Attacker identifies a WordPress site running Wishlist Member <= 3.34.1.
2. Attacker enumerates the target's numeric User ID (e.g., ID 1 for administrator).
3. Attacker crafts a malicious POST request to the wpm_register() endpoint.
4. Attacker includes the target's User ID in the 'mergewith' POST parameter.
5. Attacker includes a non-existent value in the 'wpm_id' parameter to bypass role modifications.
6. The plugin processes the request and executes wp_update_user() and $wpdb updates using attacker-supplied credentials.
7. The plugin suppresses standard WordPress security notification emails.
8. Attacker gains full unauthorized access to the target account, including administrative privileges.

Impact

Successful exploitation allows unauthenticated attackers to take over any existing user account, including those with administrator privileges. Given that the plugin suppresses security notifications, the compromise may go undetected by site owners. This leads to full administrative compromise, data exfiltration, backdooring, and potential full-site control.

Recommendation

• Update the Wishlist Member plugin to a patched version beyond 3.34.1 immediately.
• Monitor web server access logs for POST requests to registration endpoints containing the 'mergewith' and 'wpm_id' parameters.
• Implement file integrity monitoring and database auditing to detect unauthorized modifications to the wp_users table.
• Review web application logs (sc-status, cs-uri-stem) for suspicious registration patterns targeting high-privilege IDs.