CVE-2026-12949: Critical Account Takeover in WordPress Wishlist Member Plugin

Overview

A critical authentication bypass vulnerability has been identified in the Wishlist Member plugin for WordPress, tracked as CVE-2026-12949. The flaw carries a CVSS v3.1 base score of 9.8 (Critical) and allows unauthenticated attackers to take over arbitrary user accounts — including administrator accounts — without any prior credentials.

The vulnerability affects all versions of the plugin up to and including 3.34.1.

Technical Details

The root cause lies in the wpm_register() function's flawed session validation logic. During user registration, the function validates the registration cookie exclusively against the GET reg parameter while simultaneously accepting the POST body parameter _P without equivalent verification.

This asymmetry means an attacker can craft a registration request that:

1. Supplies a valid reg cookie value corresponding to any existing user
2. Submits an arbitrary _P POST body value to override the authenticated user context
3. Completes registration as — or takes over — the targeted account

Because no authentication is required to trigger wpm_register(), this is a fully unauthenticated attack vector with no user interaction needed.

CWE Classification: CWE-345 — Insufficient Verification of Data Authenticity

Impact

• Account Takeover (ATO): Full control of any WordPress account, including site administrators
• Privilege Escalation: A guest user can escalate to admin-level access
• Downstream Risk: Admin compromise leads to site defacement, backdoor installation, data exfiltration, or ransomware deployment

Affected Versions

Remediation

Update immediately. Apply the vendor patch that resolves the insufficient data authenticity validation in wpm_register(). Ensure your WordPress installation is running the latest patched release of Wishlist Member.

Recommended Actions

1. Patch now — upgrade Wishlist Member to the latest patched version
2. Audit user accounts — review recently created accounts for signs of unauthorized access
3. Check admin logs — look for unexpected admin account creation or privilege changes since August 2026
4. Enable WAF rules — temporarily restrict access to WordPress registration endpoints while patching

Detection

Monitor for anomalous account registrations, particularly:

• Multiple accounts created in rapid succession
• New administrator accounts with no corresponding email verification flow
• Registration attempts with mismatched reg cookie and POST body values

References

• NVD Entry — CVE-2026-12949
• WordPress Plugin Repository — Wishlist Member