CVE-2026-12949 is a critical vulnerability in the Wishlist Member WordPress plugin (up to and including version 3.34.1) caused by insufficient verification of data authenticity in the wpm_register() function. The function validates the registration cookie only against the GET reg parameter but accepts POST parameters mergewith and wpm_id without verifying that the mergewith user ID corresponds to a temporary or incomplete registrant tied to the current registration. This flaw allows unauthenticated attackers to supply an arbitrary user ID as mergewith, causing wp_update_user() to overwrite the target user's username, password, email, first name, and last name with attacker-controlled values. Password and email change notifications are suppressed, and if wpm_id references a non-existent membership level, the user's existing role (including administrator) is preserved, resulting in full privilege escalation and account takeover.

An unauthenticated attacker can fully take over any WordPress account on a site using the vulnerable Wishlist Member plugin, including administrator accounts. The attacker can overwrite critical user credentials and personal information without triggering notification emails, enabling stealthy account compromise and full privilege escalation. This poses a severe risk to site integrity, confidentiality, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity. Avoid using the vulnerable versions of the Wishlist Member plugin. Do not rely on password or email change notifications as they are suppressed by the vulnerability.