CVE-2025-10038

MediumCVSS 6.5

Published: 15/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

25th percentile - higher than 25% of all known CVEs

Summary

The Binary MLM Plan plugin for WordPress is vulnerable to limited privilege escalation in versions up to and including 3.0. The bmp_user role grants all users with manage_bmp capability by default upon registration.

Risk Assessment

Unauthenticated attackers can register and gain ability to manage plugin settings, potentially leading to control over MLM functionality.

Recommendation

Update the Binary MLM Plan plugin to the latest version. Modify default permissions of the bmp_user role to not grant settings management.

Other vulnerabilities in Binary MLM Plan

CVE-2025-11895Medium
The Binary MLM Plan plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 5.0. This is due to the bmp_user_payout_detail_of_current_user() function selecting payout records solely by id without verifying ownership. This makes it possible for authenticated attackers with the bmp_user role (often subscribers) to view other members' payout summaries via direct requests to the /bmp-account-detail/ endpoint with a crafted payout-id parameter granted they can access the shortcode output.

Original NVD description (English source)

The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role granting all users with the manage_bmp capability by default upon registration through the plugin's form. This makes it possible for unauthenticated attackers to register and manage the plugin's settings.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS