What is the CVSS score of CVE-2025-11895?

CVE-2025-11895 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-11895

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2025-10-17 security@wordfence.com

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Oct 17, 2025 - 10:15 nvd

MEDIUM 4.3

DescriptionCVE.org

The Binary MLM Plan plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 5.0. This is due to the bmp_user_payout_detail_of_current_user() function selecting payout records solely by id without verifying ownership. This makes it possible for authenticated attackers with the bmp_user role (often subscribers) to view other members' payout summaries via direct requests to the /bmp-account-detail/ endpoint with a crafted payout-id parameter granted they can access the shortcode output.

AnalysisAI

Authenticated subscribers in the Binary MLM Plan WordPress plugin up to version 5.0 can access other users' payout summaries through insecure direct object reference (IDOR) in the /bmp-account-detail/ endpoint. The vulnerability stems from the bmp_user_payout_detail_of_current_user() function failing to verify payout record ownership before returning data, allowing any authenticated user with the bmp_user role to enumerate and view arbitrary payout details by manipulating the payout-id parameter. This is a low-severity information disclosure affecting MLM WordPress sites; no public exploit code or active exploitation has been confirmed.

Technical ContextAI

The Binary MLM Plan plugin for WordPress implements a payout detail retrieval function (bmp_user_payout_detail_of_current_user) that serves the /bmp-account-detail/ endpoint and accepts a payout-id parameter. The function queries payout records from the database using only the supplied ID without performing authorization checks (CWE-639: Authorization through User-Controlled Key) to verify the requesting user owns that payout record. This is a classic IDOR vulnerability in which database record selection is performed based solely on a user-supplied identifier without verifying the requester's entitlement to that resource. The plugin uses WordPress's built-in role system, with bmp_user being a custom role typically assigned to subscribers or MLM network participants who should only access their own financial data.

Affected ProductsAI

The Binary MLM Plan WordPress plugin in versions up to and including 5.0 is vulnerable. The affected code is located in the bmp_user_payout_detail_of_current_user() function within the includes/bmp-hook-functions.php file (see WordPress.org plugin repository reference). Sites running any version of the plugin from the 1.x, 2.x, 3.x, 4.x, or 5.0 branches are affected if the /bmp-account-detail/ endpoint is accessible to authenticated users.

RemediationAI

Upgrade the Binary MLM Plan plugin to a patched version released after 5.0. Verify the patch availability and exact fix version through the plugin's WordPress.org repository page and the Wordfence vulnerability advisory linked in references. Wordfence has provided public disclosure, indicating the vendor was notified and should have released patches; confirm the patched version before upgrading. As a temporary workaround pending patch deployment, restrict the /bmp-account-detail/ endpoint via WordPress capability checks or Web Application Firewall (WAF) rules to ensure only the account owner can request their own payout-id. Review access logs for suspicious enumerate requests to this endpoint with varying payout-id parameters.