The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a temporary or incomplete registrant that is bound to the current registration transaction. This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by supplying an arbitrary user's numeric ID as the mergewith value, which causes wp_update_user() to overwrite the target account's username (additionally written via a direct $wpdb UPDATE), password, email address, first name, and last name with attacker-controlled values, while WordPress password and email change notification emails are explicitly suppressed. When wpm_id r
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
The Wishlist Member plugin for WordPress (versions ≤3.34.1) contains a critical account takeover vulnerability stemming from insufficient verification of data authenticity in its registration function. The vulnerability exists because the wpm_register() function validates registration cookies against only the GET 'reg' parameter while blindly accepting POST parameters 'mergewith' and 'wpm_id' without confirming these reference legitimate temporary registrants. This allows attackers to manipulate account registration workflows, potentially taking over existing accounts by merging unauthorized registration attempts with target user accounts. With a CVSS score of 9.8, this affects all WordPress installations using the vulnerable plugin versions, impacting e-learning platforms, membership sites, and any organization leveraging Wishlist Member for user management.
While MITRE ATT&CK techniques are not formally mapped to this CVE, Casky's security skills powered by Claude would identify the attack pattern as abuse of legitimate application functionality—specifically improper input validation and insufficient authentication checks. A practitioner using Casky would observe detection signals including: abnormal POST parameter sequences during registration flows, account merge operations originating from unexpected sources, mismatched user context between GET and POST requests, and successful account associations without corresponding email verification. Claude's extended reasoning capability would correlate these signals across the 754 mapped security skills, flagging suspicious registration transaction patterns that deviate from normal user onboarding behavior, enabling defenders to identify compromise attempts before account takeover completes.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-12949. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation