01 Record

CVE-2026-12949

Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter

CriticalPUBLISHEDCNA: Wordfence

Base score9.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

02 Description

Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter

Published: 2026-08-14 05:30Z13 HR AGO
Last updated: 2026-08-14 14:59Z3 HR AGO
Reserved: 2026-06-22
Assigning CNA: Wordfence
Record state: PUBLISHED
Severity: Critical (CVSS 9.8)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-640
SSVC decision: ExploitationnoneAutomatableyesTechnical Impacttotal
Data version: 5.2
Document digest: 9c398746d97c1e9b6630384bc247eefd30c834884b8f887836cb0b8e3813a59b

VendorProductVersionsPlatforms

Wishlist MemberWishlist Member0 to 3.34.1—