Atomic Edge analysis of CVE-2026-12949 (metadata-based): This vulnerability allows unauthenticated attackers to take over any existing WordPress account, including administrators, in the Wishlist Member X plugin versions up to and including 3.34.1. The flaw resides in the wpm_register() function, which improperly validates the registration cookie and accepts attacker-controlled ‘mergewith’ and ‘wpm_id’ parameters without ensuring the ‘mergewith’ user ID belongs to a temporary, incomplete registrant tied to the current session. With a CVSS score of 9.8 and no authentication or user interaction required, this is a critical account takeover and privilege escalation vector.
Root cause: The CWE classification (CWE-640, Weak Password Recovery Mechanism) and the vulnerability description indicate that the plugin fails to enforce data authenticity in the account merging logic. The wpm_register() function checks the registration cookie against the GET ‘reg’ parameter, but it trusts the POST ‘mergewith’ and ‘wpm_id’ values without verifying that the ‘mergewith’ ID refers to a user record created as part of the current registration flow. Atomic Edge analysis infers that the merge process calls wp_update_user() and also performs a direct $wpdb UPDATE on the user’s username, overwriting the target account’s credentials and profile fields with attacker-supplied values. The plugin suppresses the standard WordPress password and email change notifications, allowing silent takeover. When ‘wpm_id’ references a non-existent membership level, the update payload omits a role key, so wp_update_user() preserves the target user’s existing role, resulting in immediate privilege escalation to the taken account’s original role (e.g., administrator). These conclusions are inferred from the CWE, CVSS vector, and description; no source code diff was available for confirmation.
Exploitation: An unauthenticated attacker sends a crafted HTTP POST request to the plugin’s registration form handler. The attacker starts a registration transaction by providing a valid ‘reg’ GET parameter that passes the cookie check. In the same request, the attacker sets ‘mergewith’ to the numeric user ID of an existing WordPress user (e.g., an administrator) and sets ‘wpm_id’ to a non-existent membership level value. The request also includes attacker-controlled values for ‘user_login’, ‘user_pass’, ‘user_email’, ‘first_name’, and ‘last_name’. The vulnerable wpm_register() function calls wp_update_user() with these fields, overwriting the target user’s credentials without sending notification emails. Because no role is specified, the target’s administrator role remains intact. The attacker can then log in to the target account using the newly set credentials and gain full administrative access. A realistic PoC would send the registration request with the ‘mergewith’ parameter set to the target user ID and the required registration form fields.
Remediation: The patched version (3.34.2) likely fixes this by strictly associating any ‘mergewith’ user ID with a temporary user record created during the exact registration session. The plugin must verify that the ‘mergewith’ ID corresponds to a user with a specific temporary role or meta flag that was set during the current unauthenticated registration flow. The plugin should also ensure that ‘wpm_id’ references a valid membership level and, if not, abort the update rather than leaving the role undefined. Best practices include using WordPress nonces for all form submissions, validating that the ‘mergewith’ user record belongs to the current session, and never allowing arbitrary user IDs to be passed into wp_update_user() without strict checks. Atomic Edge analysis recommends that the plugin also re-enable notification emails for any credential or email changes as a defense-in-depth measure.
Impact: Successful exploitation results in complete account takeover with no authentication, allowing an attacker to gain the same privileges as the compromised account. If the target is an administrator, the attacker gains full site control, including the ability to upload plugins, modify themes, create backdoor users, and potentially execute arbitrary code through plugin or template edits. Data confidentiality and integrity are compromised, and the absence of email notifications allows silent persistence. The high CVSS score and the trivial exploitation requirements make this a critical risk for any site running a vulnerable version of Wishlist Member X. Atomic Edge research strongly recommends immediate patching to version 3.34.2 and monitoring for suspicious registration activity.
