CVE-2024-37107 HIGH

CVE-2024-37107: WordPress WishList Member X plugin < 3.26.7 - Authenticated Privilege Escalation vulnerability

Vendor Membership Software
Product WishList Member X
Weakness CWE-269
Published June 24, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Privilege Management vulnerability in Membership Software WishList Member X allows Privilege Escalation.This issue affects WishList Member X: from n/a before 3.26.7.

Explanation of Vulnerability in Simple Terms

02Summary

WishList Member X before version 3.26.7 contains a privilege management flaw that allows authenticated users with low-level access to gain unauthorized elevated privileges. An attacker with a basic user account can read sensitive data, modify site content, and disrupt service availability. This affects all versions before 3.26.7.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify content, and disrupt site availability with a low-privilege user account.

Potential impact on your site

04Site Impact

Compromised user accounts can escalate to admin-level access, exposing member data and allowing unauthorized site modifications.

Conditions required to exploit

05Prerequisites

Attacker must have a valid low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

June 24, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-12415 Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter CVE-2026-3629 Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields CVE-2026-14956 Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter CVE-2026-1750 Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access CVE-2026-12165 Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter