plugin
24 known security issues reported for the Wishlist Member X WordPress plugin. Most recent disclosed Aug 13, 2026.
Running Wishlist Member X on your site? Check whether your installed version is affected.
Scan your site freeThe Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and PO...
The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation in versions up to and including 3.30.1. This is due to the missing capability checks in the 'export_settings' function. This function returns the REST API Secret Key to th...
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\Features\Team_Accounts::save_settings' function in all versions up to, and including, 3.32.0. This makes it possible for authenticated attackers, with Subscriber-level acc...
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember3_Hooks::generate_api_key' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...
The WishList Member plugin for WordPress is vulnerable to Privilege Escalation via Missing Authorization in versions up to and including 3.30.1. This is due to the missing capability and nonce check in the ajax_get_screen() function. This makes it possible for authenticated attackers, with Subscriber-level access and a...
The Wishlist Member plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 3.32.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may...
The Wishlist Member plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.32.0 via deserialization of untrusted input. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnera...
The WishList Member X plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.32.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
[en] Missing Authorization vulnerability in WishList Products WishList Member X allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WishList Member X: from n/a through 3.26.6
[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WishList Products WishList Member X allows Path Traversal.This issue affects WishList Member X: from n/a through 3.26.6.
[en] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
[en] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
[en] Missing Authorization vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
[en] Improper Privilege Management vulnerability in Membership Software WishList Member X allows Privilege Escalation.This issue affects WishList Member X: from n/a before 3.26.7.
[en] Improper Control of Generation of Code ('Code Injection') vulnerability in Membership Software WishList Member X allows Code Injection.This issue affects WishList Member X: from n/a before 3.26.7.
The WishList Member X plugin for WordPress is vulnerable SQL Injection in versions up to, and including, 3.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to run arbitrary SQL queries tha...
The Wishlist Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and excluding, 3.26.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server.
The Wishlist Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and excluding, 3.26.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain privileges higher than the ones intended.
The Wishlist Member plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and excluding, 3.26.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily l...
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the a function in all versions up to, and excluding, 3.26.7. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts.
The Wishlist Member plugin for WordPress is vulnerable to denial of service in all versions up to, and excluding, 3.26.7. This makes it possible for unauthenticated attackers to limit access to a site.
The Wishlist Member plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on a function in all versions up to, and excluding, 3.26.7. This makes it possible for unauthenticated attackers to retrieve settings and user data.
The Wishlist Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and excluding, 3.26.7 due to a weakness that allows for unauthorized downloads of the sites database backup. This makes it possible for unauthenticated attackers to extract sensitive information from a sites...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free