6.5
Medium
CVE-2026-19711 The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's…
Description
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Premium Packages 7.0 | earliest → < 7.0.7 | 7.0.7 |
Other CVEs of Premium Packages
The 6 CVEs of Premium Packages →
CVE-2026-118407
Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover
5.4
Medium
CVE-2026-118404
Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR
5.3
Medium
CVE-2026-118403
Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure
3.7
Low
CVE-2026-118184
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the…
5.3
Medium