CVE-2026-10782

MediumCVSS 4.3

Published: 01/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 3.0.9 due to improper verification of user permissions. This allows authenticated attackers with subscriber-level access or above to grant themselves any premium membership tier without completing a PayPal transaction.

Risk Assessment

An attacker can gain unauthorized access to restricted features and privileges by generating a falsified payment receipt. This could lead to financial losses and compromise the integrity of the membership system.

Recommendation

Immediately update the RealHomes Memberships plugin to the latest version that fixes this vulnerability. Also strengthen PayPal transaction validation.

Other vulnerabilities in RealHomes Memberships

CVE-2026-15246Medium
The RealHomes Memberships WordPress plugin before version 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package. This allows any authenticated user such as a Subscriber to obtain paid membership packages without paying.

Original NVD description (English source)

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves any premium membership tier without completing a PayPal transaction, generating a falsified active payment receipt and gaining unauthorized access to restricted property listing allowances.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS