WordPress plugin
Wishlist Member security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 16 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High9
- Medium4
- Low0
All Wishlist Member vulnerabilities
- Critical9.8Unauthenticated Account Takeover via 'mergewith' Parameter
≤3.34.1Update to 3.34.2
- High8.8Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action
≤3.30.1Update to 3.31.0
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action
≤3.32.0Update to 3.32.1
- High8.8Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action
≤3.30.1Update to 3.31.0
- High8.8Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action
≤3.30.1Update to 3.31.0
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤3.32.0Update to 3.33.0
- High7.5Authenticated (Subscriber+) PHP Object Injection
≤3.32.0Update to 3.33.0
- Medium4.3Missing Authorization
≤3.32.0Update to 3.33.0
- Critical9.9Authenticated (Subscriber+) Remote Code Execution
<3.26.7Update to 3.26.7
- Critical10.0Unauthenticated Arbitrary SQL Execution
<3.26.7Update to 3.26.7
- High8.8Authenticated (Subscriber+) Privilege Escalation
<3.26.7Update to 3.26.7
- Medium5.3Missing Authorization to Information Disclosure
<3.26.7Update to 3.26.7
- Medium5.3Unauthenticated Information Exposure
<3.26.7Update to 3.26.7
- Medium5.3Unauthenticated Denial of Service
<3.26.7Update to 3.26.7
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
<3.26.7Update to 3.26.7
- High7.2Missing Authorization to Stored Cross-Site Scripting
<3.26.7Update to 3.26.7
Wishlist Member: common questions
Does Wishlist Member have known vulnerabilities?
Yes. VulnCrest Radar lists 16 known vulnerabilities in Wishlist Member: 3 critical, 9 high, 4 medium. None are known to affect version null.
How do I check which version of Wishlist Member I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Wishlist Member vulnerability?
CVE-2026-12949, published Aug 13, 2026: Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter. Severity: Critical (CVSS 9.8).
Is any Wishlist Member vulnerability listed in CISA KEV?
No. None of the known Wishlist Member vulnerabilities is currently listed in the CISA KEV catalog.