A critical flaw (CVSS 9.8) in the Wishlist Member plugin for WordPress lets unauthenticated attackers overwrite any existing account, including administrators, by supplying that account's numeric user ID during registration.
What Is It
CVE-2026-12949 is a Weak Password Recovery Mechanism for Forgotten Password issue (CWE-640) in the plugin's wpm_register() function. The function validates the registration cookie only against the GET reg parameter, while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID actually references a temporary or incomplete registrant bound to the current registration transaction.
An attacker who supplies an arbitrary user's numeric ID as mergewith causes wp_update_user() to overwrite the target account's username (additionally written via a direct $wpdb UPDATE), password, email address, first name, and last name with attacker-controlled values. WordPress password and email change notification emails are explicitly suppressed, so the legitimate account holder receives no warning.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact.
Privilege escalation is a direct consequence of the takeover: when wpm_id references a non-existent membership level, no role key is added to the update payload, so wp_update_user() preserves the target user's existing role; including administrator. The result is full administrative control of the site by an unauthenticated attacker, with change notifications suppressed.
What's Vulnerable
- Vendor/Product: Wishlist Member (WordPress plugin)
- Affected versions: all versions up to and including 3.34.1
- Severity: CRITICAL, CVSS 3.1 base score 9.8
- Weakness: CWE-640 (Weak Password Recovery Mechanism for Forgotten Password)
Patch Status
The supplied NVD record lists a vulnStatus of "Received" (published 2026-08-14) and does not identify a fixed version or specify remediation steps. There is no CISA KEV entry in the supplied source material, so active exploitation is not confirmed by KEV at this time. Administrators should consult the vendor and Wordfence advisory below for fix availability.
Sources
- NVD, CVE-2026-12949: https://nvd.nist.gov/vuln/detail/CVE-2026-12949
- Wordfence Threat Intelligence advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/84afe5a7-1bf4-4b83-bf77-efbb003a30cd?source=cve
- Wishlist Member (vendor): https://wishlistmember.com/