Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember3_Hooks::generate_api_key' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
CVE-2026-6898 Wishlist Memberプラグイン（バージョン3.30.1まで）の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/06/cve-2026-6898-wishlist-member3301/ #IT #Security #cybersecurity
Post summary
The post provides a disclosure and explanation of CVE-2026-6898, including technical details and likely mitigation steps, without evidence of PoC, active exploitation, or debunking.
CVE-2026-6898 The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember3_Hooks::generate_ap… https://www.cve.org/CVERecord?id=CVE-2026-6898
Post summary
The entry announces that the Wishlist Member plugin for WordPress is vulnerable to unauthorized data modification because of a missing capability check; no proof of concept, exploit, or patch information is provided.