CVE-2026-12949

Name of the Vulnerable Software and Affected Versions Wishlist Member versions prior to 3.34.2

Description Insufficient verification of data authenticity allows unauthenticated attackers to take over any WordPress account, including those with administrator privileges. The issue occurs within the wpm register() function, which validates the registration cookie only against the reg GET parameter but fails to verify that the mergewith POST parameter references a temporary or incomplete registrant bound to the current transaction. By providing an arbitrary user ID in the mergewith parameter, an attacker can trigger wp update user() to overwrite the target account's username, password, email, and name with attacker-controlled values. Furthermore, password and email change notifications are suppressed. If the wpm id POST parameter references a non-existent membership level, the target user's existing role is preserved, leading to full privilege escalation.

Recommendations Update Wishlist Member to a version newer than 3.34.1. As a temporary workaround, restrict access to the registration functionality that utilizes the wpm register() function.