Skip to content
Threat Feed

Tag

CVE-2026-6419

1 brief RSS
critical threat

WishList Member Plugin Privilege Escalation via Missing Authorization (CVE-2026-6419)

The WishList Member plugin for WordPress is vulnerable to privilege escalation (CVE-2026-6419) due to a missing capability and nonce check in the ajax_get_screen() function, allowing authenticated attackers with subscriber-level access to retrieve the plugin's REST API Secret Key and create administrator accounts, leading to complete site takeover.

WishList Member plugin privilege-escalation wordpress plugin CVE-2026-6419
2r 1t 1c