Binary Mlm Plan
Approved changes feed: RSS · Atom
cpe:2.3:a:letscms:binary_mlm_plan:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Letscms (40c34f72-4b45-5ac6-851b-ca879a09f83c) |
|---|---|
| Product | Binary Mlm Plan (20bd4e7f-2065-5e22-b27b-1a585afe16a0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-11895 |
vulnerable | 2026-06-08 07:04:29.367314 |
Binary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
MEDIUM (4.3)
The Binary MLM Plan plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 5.0. This is due to the bmp_user_payout_detail_of_current_user() function selecting payout records solely by id without verifying ownership. This makes it possible for authenticated attackers with the bmp_user role (often subscribers) to view other members' payout summaries via direct requests to the /bmp-account-detail/ endpoint with a crafted payout-id parameter granted they can access the shortcode output.
Published: 2025-10-17T09:26:39.563Z
Updated: 2026-04-08T17:15:11.474Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-10038 |
vulnerable | 2026-06-08 07:02:26.198692 |
Binary MLM Plan <= 3.0 - Unauthenticated Limited Privilege Escalation
MEDIUM (6.5)
The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role granting all users with the manage_bmp capability by default upon registration through the plugin's form. This makes it possible for unauthenticated attackers to register and manage the plugin's settings.
Published: 2025-10-15T08:25:57.132Z
Updated: 2026-04-08T17:02:09.537Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.