Skip to content
OpenAdvisories

Product · letscms

Binary MLM Plan

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-11895

    Binary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference

    The Binary MLM Plan plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 5.0. This is due to the bmp_user_payout_detail_of_current_user() function selecting payout records solely by id without verifying owne…

    letscms Binary MLM Plan Web / CMS
  • Medium 6.5
    CVE-2025-10038

    Binary MLM Plan <= 3.0 - Unauthenticated Limited Privilege Escalation

    The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role granting all users with the manage_bmp capability by default upon registration through the plugin's …

    letscms Binary MLM Plan Web / CMS