CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
The Binary MLM Plan plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 5.0. This is due to the bmp_user_payout_detail_of_current_user() function selecting payout records solely by id without verifying ownership. This makes it possible for authenticated attackers with the bmp_user role (often subscribers) to view other members' payout summaries via direct requests to the /bmp-account-detail/ endpoint with a crafted payout-id parameter granted they can access the shortcode output.
AnalysisAI
Authenticated subscribers in the Binary MLM Plan WordPress plugin up to version 5.0 can access other users' payout summaries through insecure direct object reference (IDOR) in the /bmp-account-detail/ endpoint. The vulnerability stems from the bmp_user_payout_detail_of_current_user() function failing to verify payout record ownership before returning data, allowing any authenticated user with the bmp_user role to enumerate and view arbitrary payout details by manipulating the payout-id parameter. This is a low-severity information disclosure affecting MLM WordPress sites; no public exploit code or active exploitation has been confirmed.
Technical ContextAI
The Binary MLM Plan plugin for WordPress implements a payout detail retrieval function (bmp_user_payout_detail_of_current_user) that serves the /bmp-account-detail/ endpoint and accepts a payout-id parameter. The function queries payout records from the database using only the supplied ID without performing authorization checks (CWE-639: Authorization through User-Controlled Key) to verify the requesting user owns that payout record. This is a classic IDOR vulnerability in which database record selection is performed based solely on a user-supplied identifier without verifying the requester's entitlement to that resource. The plugin uses WordPress's built-in role system, with bmp_user being a custom role typically assigned to subscribers or MLM network participants who should only access their own financial data.
Affected ProductsAI
The Binary MLM Plan WordPress plugin in versions up to and including 5.0 is vulnerable. The affected code is located in the bmp_user_payout_detail_of_current_user() function within the includes/bmp-hook-functions.php file (see WordPress.org plugin repository reference). Sites running any version of the plugin from the 1.x, 2.x, 3.x, 4.x, or 5.0 branches are affected if the /bmp-account-detail/ endpoint is accessible to authenticated users.
RemediationAI
Upgrade the Binary MLM Plan plugin to a patched version released after 5.0. Verify the patch availability and exact fix version through the plugin's WordPress.org repository page and the Wordfence vulnerability advisory linked in references. Wordfence has provided public disclosure, indicating the vendor was notified and should have released patches; confirm the patched version before upgrading. As a temporary workaround pending patch deployment, restrict the /bmp-account-detail/ endpoint via WordPress capability checks or Web Application Firewall (WAF) rules to ensure only the account owner can request their own payout-id. Review access logs for suspicious enumerate requests to this endpoint with varying payout-id parameters.
Share
External POC / Exploit Code
Leaving vuln.today