CVE-2026-15246

MediumCVSS 4.3

Published: 06/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

The RealHomes Memberships WordPress plugin before version 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package. This allows any authenticated user such as a Subscriber to obtain paid membership packages without paying.

Risk Assessment

The organization may suffer financial losses as users can obtain paid features without payment, and it may also lead to unauthorized access to resources.

Recommendation

Immediately update the plugin to version 3.1.0 or later and implement additional payment verification controls.

Other vulnerabilities in RealHomes Memberships

CVE-2026-10782Medium
The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 3.0.9 due to improper verification of user permissions. This allows authenticated attackers with subscriber-level access or above to grant themselves any premium membership tier without completing a PayPal transaction.

Original NVD description (English source)

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages without paying.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS