Premium Packages
Monthly
Improper payout validation in the Premium Packages WordPress plugin (all versions before 7.0.7) allows any authenticated user - including subscribers with zero sales history - to submit withdrawal requests for arbitrary monetary amounts. Because the plugin never cross-references the requested amount against the user's actual earned balance, a low-privilege attacker can fabricate a payout claim that an administrator may approve and disburse as real funds. A publicly available proof-of-concept exists; no confirmed active exploitation (CISA KEV) has been recorded, and EPSS probability stands at 0.14% (4th percentile), suggesting opportunistic rather than widespread targeting.
Improper payout validation in the Premium Packages WordPress plugin (all versions before 7.0.7) allows any authenticated user - including subscribers with zero sales history - to submit withdrawal requests for arbitrary monetary amounts. Because the plugin never cross-references the requested amount against the user's actual earned balance, a low-privilege attacker can fabricate a payout claim that an administrator may approve and disburse as real funds. A publicly available proof-of-concept exists; no confirmed active exploitation (CISA KEV) has been recorded, and EPSS probability stands at 0.14% (4th percentile), suggesting opportunistic rather than widespread targeting.