What is the CVSS score of CVE-2026-19711?

CVE-2026-19711 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-19711?

Yes, a public proof-of-concept exploit is available for CVE-2026-19711. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-19711?

Yes, a patch is available for CVE-2026-19711. Update the affected software to the latest version immediately.

Premium Packages CVE-2026-19711

EUVD-2026-59914 MEDIUM

Improper Access Control (CWE-284)

2026-08-16 WPScan

GHSA-m363-6834-c3r7

WordPress Authentication Bypass Premium Packages Unknown

6.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible plugin endpoint requires only subscriber-level auth (PR:L); no confidentiality or availability impact, only financial integrity manipulation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 21:29 vuln.today

CVSS changed

Aug 17, 2026 - 21:22 NVD

6.5 (None) 6.5 (MEDIUM)

Patch available

Aug 16, 2026 - 07:01 EUVD

CVE Published

Aug 16, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 16, 2026 - 06:00 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.

AnalysisAI

Improper payout validation in the Premium Packages WordPress plugin (all versions before 7.0.7) allows any authenticated user - including subscribers with zero sales history - to submit withdrawal requests for arbitrary monetary amounts. Because the plugin never cross-references the requested amount against the user's actual earned balance, a low-privilege attacker can fabricate a payout claim that an administrator may approve and disburse as real funds. A publicly available proof-of-concept exists; no confirmed active exploitation (CISA KEV) has been recorded, and EPSS probability stands at 0.14% (4th percentile), suggesting opportunistic rather than widespread targeting.

Technical ContextAI

The affected component is the Premium Packages WordPress plugin, a marketplace extension that manages digital-product sales, vendor balances, and payout workflows. The root cause is classified as CWE-284 (Improper Access Control): the server-side handler that processes withdrawal requests omits a server-side authorisation check verifying that the requesting user's pending payout does not exceed their actual earned balance. This is a classic missing business-logic validation - the plugin likely enforces UI-level restrictions but fails to replicate those constraints at the API or form-processing layer. Affected CPE: cpe:2.3:a:unknown:premium_packages:*:*:*:*:*:*:*:* covering all versions prior to 7.0.7, as reported by WPScan.

RemediationAI

Update the Premium Packages WordPress plugin to version 7.0.7 or later, which introduces server-side validation of withdrawal amounts against actual earned balances. The vendor-released patch is confirmed available; administrators should apply it immediately via the WordPress plugin update mechanism. If immediate patching is not possible, a targeted compensating control is to temporarily disable the payout/withdrawal submission feature or restrict access to the withdrawal endpoint to trusted vendor roles only - not all authenticated subscriber accounts. Additionally, administrators should audit recent payout requests for anomalous amounts that do not correspond to any sales records. References: WPScan advisory at https://wpscan.com/vulnerability/ba209669-49bb-40f0-976d-7b77fa0a3c85/ and VulDB at https://vuldb.com/vuln/391119.