WordPress RealHomes Memberships plugin < 3.1.0 - Subscriber+ Membership Payment Bypass vulnerability

Subscriber+ Membership Payment Bypass vulnerability discovered by Pablo González and Fran Ramírez in WordPress Plugin RealHomes Memberships versions 3.1.0...

CVE-2026-15246

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

CVE-2026-15246 RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

CVE-2026-15246 RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

CVE-2026-15246

Vulnerability summary (CVE-2026-15246). The RealHomes Memberships WordPress plugin prior to version 3.1.0 fails to verify that a membership payment completed, and does not check a nonce or user capability before granting a paid membership package. This allows any authenticated user (e.g., a Subsc...

CVE-2026-15246: Insufficient Verification of Data Authenticity

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

CVE-2026-10782

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-10782

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-10782

CVE-2026-10782 affects the RealHomes Memberships plugin for WordPress. All versions up to and including 3.0.9 are vulnerable to an authorization bypass in the ims_add_paypal_recurring_membership AJAX action, due to improper verification of user permissions. This allows authenticated users with su...

CVE-2026-10782 RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-10782 RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-10782: Missing Authorization

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

PT-2026-67005

Name of the Vulnerable Software and Affected Versions RealHomes Memberships versions prior to 3.1.0 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or...

WordPress RealHomes Memberships plugin <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass vulnerability

Missing Authorization to Authenticated Subscriber+ Membership Payment Bypass vulnerability discovered by dyingman in WordPress Plugin RealHomes Memberships versions = 3.0.9...