Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\Features\Team_Accounts::save_settings' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options, includes the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-23 | 1 | Disclosure1 |
| 2026-06-09 | 1 | Patch1 |
CVE-2026-6897 The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\Features\Team_Accou… https://www.cve.org/CVERecord?id=CVE-2026-6897
Post summary
The post discloses that the WordPress Wishlist Member plugin has a missing capability check allowing unauthorized data modification, forming CVE‑2026‑6897.
CVE-2026-6897 Wishlist Memberの脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/06/cve-2026-6897-wishlist-member/ #IT #Security #cybersecurity
Post summary
The article announces CVE‑2026‑6897 and summarizes mitigation steps, but does not provide a PoC, exploit code, evidence of active exploitation, or detailed technical data.