WishList Member Missing Authorization Vulnerability Allows Privilege Escalation and Site Takeover

A vulnerability exists in the WishList Member plugin for WordPress, in all versions through 3.30.1, due to a lack of proper capability checks in the 'WishListMember3_Hooks::generate_api_key' function. This flaw enables authenticated attackers with Subscriber-level access or higher to modify the REST API Secret Key. Exploiting this vulnerability could lead to the creation of a new membership level assigned the administrator role, as well as the registration of an arbitrary user with administrator privileges, resulting in complete control over the site.

Impact

Exploitation of this vulnerability allows for unauthorized modification of data, specifically the REST API Secret Key, which can be misused to escalate privileges and take over the site by creating new administrator accounts or roles.

Remediation

Users are advised to update to version 3.31.0 or a newer patched version.