CVE-2026-25446: WordPress WishList Member X plugin <= 3.29.0 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability affects the WishList Member X WordPress plugin at version 3.29.0 and earlier. It is reachable over the network and requires only a low-privilege (subscriber-level) account, with no victim interaction needed. Successful exploitation gives an attacker full read, write, and availability control over the affected environment, including the ability to execute remote code by uploading a malicious file. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  A low-privilege account (subscriber level) is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker can complete the upload entirely on their own without any action from another user.

• Attack complexityDetail

  Exploit complexity is low, meaning the attack is reliable and requires no special conditions, race timing, or environmental factors to succeed.

Blast Radius

• Attacker uploads and executes arbitrary server-side code, achieving remote code execution on the WordPress host.
• Attacker reads all stored application data, including user records, membership credentials, and any secrets accessible to the web process.
• Attacker modifies or deletes files, database content, and plugin configuration, corrupting site integrity.
• Attacker can crash or destabilize the affected service, causing a full availability outage for site visitors and members.