Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation in versions up to and including 3.30.1. This is due to the missing capability checks in the 'export_settings' function. This function returns the REST API Secret Key to the attacker in the AJAX JSON response. An attacker who obtains this key can authenticate to the WishList Member API, create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-23 | 1 | Disclosure1 |
| 2026-06-07 | 1 | Patch1 |
| 2026-06-09 | 1 | Disclosure1 |
CVE-2026-6895 WordPress用WishList Memberプラグイン（バージョン3.30.1まで）の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/06/cve-2026-6895-wordpresswishlist-member3301/ #IT #Security #cybersecurity
Post summary
The article announces and explains CVE-2026-6895 affecting WordPress WishList Member plugin up to v3.30.1, outlining its impact and providing mitigation steps.
CVE-2026-6895 WordPress用WishList Memberプラグイン（バージョン3.30.1まで）の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/06/cve-2026-6895-wordpresswishlist-member3301/ #IT #Security #cybersecurity
Post summary
The linked article explains CVE-2026-6895 affecting the WishList Member WordPress plugin, detailing its impact and providing countermeasures, but does not mention any PoC or exploit.
CVE-2026-6895 The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation in versions up to a… https://www.cve.org/CVERecord?id=CVE-2026-6895
Post summary
The WishList Member plugin for WordPress suffers from a missing authorization flaw that can expose sensitive information and enable privilege escalation; no proof‑of‑concept, active exploitation, or mitigation is reported.