EUVD-2026-53935
GHSA-qgvv-r5pp-fcw2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible endpoint requires only a low-privilege subscriber session; no confidentiality or availability impact, integrity limited to unauthorized membership grant.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages without paying.
AnalysisAI
RealHomes Memberships WordPress plugin before 3.1.0 permits any authenticated user - including low-privilege Subscribers - to claim paid membership packages for free by exploiting missing payment verification, absent nonce validation, and no capability checks on the membership grant endpoint. The business impact is direct financial loss for site operators running paid real estate membership tiers. No active exploitation has been confirmed by CISA KEV, but a public exploit is available via WPScan, lowering the barrier for abuse.
Technical ContextAI
RealHomes Memberships is a WordPress plugin that gates real estate listing features behind paid subscription tiers. The vulnerability stems from a server-side action handler that grants membership packages without performing three critical checks: (1) verification that an upstream payment transaction actually completed, (2) a WordPress nonce check to prevent CSRF-style abuse, and (3) a capability check to confirm the requesting user is authorized to receive a given tier. This compound omission maps conceptually to CWE-862 (Missing Authorization) and CWE-287 (Improper Authentication in the payment flow). The affected CPE is cpe:2.3:a:unknown:realhomes_memberships:*:*:*:*:*:*:*:*, covering all versions below 3.1.0. Because WordPress subscriber accounts are freely self-registerable on most sites, the attack surface is effectively any internet-accessible site running the plugin.
RemediationAI
Upgrade the RealHomes Memberships WordPress plugin to version 3.1.0 or later, which is the vendor-released patch addressing this flaw. The fix details are documented at https://wpscan.com/vulnerability/37e74b25-fb3b-4263-a136-261aeea1c30c/. If immediate upgrade is not possible, site administrators should disable the plugin entirely until patching is feasible - disabling it removes the vulnerable endpoint from the attack surface with the trade-off of losing all membership functionality. As an additional compensating control, restricting new user self-registration (Settings > General > uncheck 'Anyone can register') removes the ability for unknown actors to obtain the Subscriber-level account needed to trigger the flaw, though this does not protect against existing low-privilege accounts.
More in Realhomes Memberships
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today