CVE-2026-19711

The Premium Packages WordPress plugin is affected (before version 7.0.7). The root cause is missing validation of withdrawal requests against the requesting user’s actual earned balance, allowing any authenticated user (including a subscriber with no sales) to submit a payout request for an arbit...