CVE-2025-11895

The CVE-2025-11895 vulnerability affects Binary MLM Plan (WordPress) versions

CVE-2025-11895 Binary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference

The Binary MLM Plan plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 5.0. This is due to the bmpuserpayoutdetailofcurrentuser function selecting payout records solely by id without verifying ownership. This makes it possible for authenticate...

PT-2025-42594

Name of the Vulnerable Software and Affected Versions Binary MLM Plan plugin for WordPress versions up to and including 3.0 Description The Binary MLM Plan plugin for WordPress has an issue where an attacker can view payout summaries of other members. This occurs because the bmp user payout detai...