EUVD-2026-51743
GHSA-mm9c-22g4-wf37
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Subscriber authentication (PR:L) is required; impact is limited to integrity via unauthorized membership grant; no confidentiality or availability impact applies.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves any premium membership tier without completing a PayPal transaction, generating a falsified active payment receipt and gaining unauthorized access to restricted property listing allowances.
AnalysisAI
Authorization bypass in the RealHomes Memberships WordPress plugin (inspiry-memberships, all versions through 3.0.9) allows any authenticated subscriber to self-assign premium membership tiers without completing a PayPal transaction. The plugin's PayPal payment handler fails to verify user authorization before processing membership upgrades, enabling subscribers to generate falsified active payment receipts and unlock restricted property listing allowances. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L) reflects that exploitation is limited to authenticated users.
Technical ContextAI
The affected component is the RealHomes Memberships plugin (WordPress slug: inspiry-memberships) by InspiyThemes, a membership add-on for the RealHomes real estate theme. The root cause is CWE-862 (Missing Authorization): the PayPal payment handler - specifically class-paypal-payment-handler.php at lines 351 and 364, and payment-handler-init.php at line 82 - processes membership grants without verifying that the requesting user is entitled to perform that action. The CPE cpe:2.3:a:inspirythemes:realhomes_memberships:*:*:*:*:*:*:*:* covers all versions up to and including 3.0.9, confirmed by Wordfence and corroborated by source references to both the 3.0.7 and 3.0.9 tag branches in the WordPress plugin repository.
RemediationAI
An upstream fix has been committed to the WordPress plugin repository at changeset 3617226 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3617226%40inspiry-memberships&new=3617226%40inspiry-memberships); however, the exact released patched version number is not confirmed in the available input data. Site administrators should update to the latest available version of inspiry-memberships from the WordPress plugin directory and verify the installed version exceeds 3.0.9. As a compensating control prior to patching, administrators can disable new user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to prevent unknown parties from obtaining the subscriber access required for exploitation - note this may affect legitimate registration flows. Restricting the WordPress REST API or AJAX endpoints used by the payment handler to authenticated sessions only is a secondary option but requires custom code. Review existing subscriber accounts for unauthorized premium membership assignments as part of incident triage.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today