CVE-2026-24575
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
There is a broken access control issue in WishList Member X versions up to 3.29.0 that may allow unauthorized access to subscribers.
Risk Assessment
Organizations may be exposed to unauthorized access to subscriber data, potentially leading to information leaks and privacy violations.
Recommendation
It is recommended to upgrade to the latest version of WishList Member to mitigate this vulnerability.
Other vulnerabilities in WishList Member X
See all- CVE-2026-25446Critical
In WishList Member X versions up to 3.29.0, there is a vulnerability that allows subscribers to upload arbitrary files.
- CVE-2026-57384Medium
WishList Member X plugin version 3.32.0 and earlier is vulnerable to Cross Site Scripting (XSS) from a subscriber level. A subscriber can inject malicious script.
Original NVD description (English source)
Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS