This vulnerability (CVE-2026-24575) affects WishList Member X versions <= 3.29.0 and is categorized as CWE-862 Missing Authorization. It results from broken access control mechanisms for subscriber roles, potentially allowing unauthorized users to access functionality or data they should not. The CVSS 3.1 base score is 4.3, indicating a medium impact primarily on confidentiality with no impact on integrity or availability. No official fix or remediation level has been published, and no known exploits have been reported.

The vulnerability allows unauthorized access due to missing authorization checks, which can lead to limited confidentiality impact. There is no reported impact on integrity or availability. Since the attack vector is network-based with low attack complexity and requires low privileges, an attacker with some access could exploit this to gain unauthorized read access to subscriber-related data or functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's communications for updates. Until a patch is available, restrict access to the affected versions and consider additional access control measures to limit exposure.