CVE-2026-6898

설명

The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember3_Hooks::generate_api_key' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.

영향 제품·버전

제품 Wishlist Member

영향 버전 Wishlist Member <= 3.30.1

수정 버전 Wishlist Member · 수정 버전은 공급사 공식자료 확인 필요

기술 정보

CVSS 벡터 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE CWE-269