6.5
Moyenne
CVE-2026-19711 The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's…
Description
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Premium Packages 7.0 | premières → < 7.0.7 | 7.0.7 |
Autres CVE de Premium Packages
Les 6 CVE de Premium Packages →
CVE-2026-118407
Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover
5.4
Moyenne
CVE-2026-118404
Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR
5.3
Moyenne
CVE-2026-118403
Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure
3.7
Faible
CVE-2026-118184
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the…
5.3
Moyenne