CVE-2024-37108: Arbitrary File Access in Wishlist Member

The primary impact of CVE-2024-37108 is the ability for an authenticated attacker to delete arbitrary files on a WordPress server. While seemingly limited to file deletion, the vulnerability's severity stems from the potential to delete critical configuration files. Deletion of wp-config.php, for example, would effectively grant the attacker complete control over the WordPress instance, allowing for arbitrary code execution. This could lead to data breaches, website defacement, malware installation, and complete system compromise. The relatively low access requirement (Subscriber level) significantly expands the potential attack surface.

1. Reserved2024-06-03
2. Published2024-06-20
3. Modified2026-02-26
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-37108 is to immediately upgrade the Wishlist Member plugin to version 3.26.7 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider restricting file permissions on the WordPress server to limit the attacker's ability to delete sensitive files. Implement a Web Application Firewall (WAF) with rules to block suspicious file deletion requests. Monitor WordPress access logs for unusual file deletion activity. After upgrading, verify the fix by attempting a file deletion request with a low-privileged user account to confirm that access is properly restricted.