WishList Member vulnerabilities and threats

The CourseCure Courses WordPress plugin up to version 1.5.1 contains a privilege escalation vulnerability due to missing authorization checks in the ajax_save_settings() function. Authenticated users with subscriber-level access or higher can exploit this flaw by modifying WordPress options to set the default role to administrator and enable user registration, allowing them to create new administrator accounts.

CVE-2026-24575 is a medium severity vulnerability in WishList Member X versions up to and including 3.29.0. It involves broken access control related to subscriber authorization, classified under CWE-862. The vulnerability allows unauthorized access due to missing authorization checks. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.