Realhomes Memberships
Monthly
RealHomes Memberships WordPress plugin before 3.1.0 permits any authenticated user - including low-privilege Subscribers - to claim paid membership packages for free by exploiting missing payment verification, absent nonce validation, and no capability checks on the membership grant endpoint. The business impact is direct financial loss for site operators running paid real estate membership tiers. No active exploitation has been confirmed by CISA KEV, but a public exploit is available via WPScan, lowering the barrier for abuse.
Authorization bypass in the RealHomes Memberships WordPress plugin (inspiry-memberships, all versions through 3.0.9) allows any authenticated subscriber to self-assign premium membership tiers without completing a PayPal transaction. The plugin's PayPal payment handler fails to verify user authorization before processing membership upgrades, enabling subscribers to generate falsified active payment receipts and unlock restricted property listing allowances. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L) reflects that exploitation is limited to authenticated users.
RealHomes Memberships WordPress plugin before 3.1.0 permits any authenticated user - including low-privilege Subscribers - to claim paid membership packages for free by exploiting missing payment verification, absent nonce validation, and no capability checks on the membership grant endpoint. The business impact is direct financial loss for site operators running paid real estate membership tiers. No active exploitation has been confirmed by CISA KEV, but a public exploit is available via WPScan, lowering the barrier for abuse.
Authorization bypass in the RealHomes Memberships WordPress plugin (inspiry-memberships, all versions through 3.0.9) allows any authenticated subscriber to self-assign premium membership tiers without completing a PayPal transaction. The plugin's PayPal payment handler fails to verify user authorization before processing membership upgrades, enabling subscribers to generate falsified active payment receipts and unlock restricted property listing allowances. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L) reflects that exploitation is limited to authenticated users.