PT-2025-42594 · WordPress · Binary Mlm Plan

Published 2025-10-17 · Updated 2025-10-17 · CVE-2025-11895

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Binary MLM Plan plugin for WordPress versions up to and including 3.0

Description The Binary MLM Plan plugin for WordPress has an issue where an attacker can view payout summaries of other members. This occurs because the bmp user payout detail of current user() function selects payout records using the payout-id parameter without checking if the current user has permission to view that record. An authenticated attacker with the bmp user role can make direct requests to the /bmp-account-detail/ API endpoint with a crafted payout-id parameter to access payout information they are not authorized to see.

Recommendations Update to a version of the Binary MLM Plan plugin for WordPress later than 3.0.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-11895

Affected Products

Binary Mlm Plan

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11895 · Security Note
• https://plugins.trac.wordpress.org/browser/binary-mlm-plan/trunk/includes/bmp-hook-functions.php#L833 · Note
• https://twitter.com/VulmonFeeds/status/1979143590744850833 · Twitter Post
• https://t.me/CVEtracker/35180 · Telegram Post
• https://t.me/cveNotify/139106 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/adba7d0c-29ca-49c5-ac75-bb79d62f6107?source=cve · Note