Vulnerability · Published Oct 17, 2025 · Assigned by Wordfence
CVE-2025-11895Binary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in Binary MLM Plan from letscms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
The Binary MLM Plan plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 5.0. This is due to the bmp_user_payout_detail_of_current_user() function selecting payout records solely by id without verifying ownership. This makes it possible for authenticated attackers with the bmp_user role (often subscribers) to view other members' payout summaries via direct requests to the /bmp-account-detail/ endpoint with a crafted payout-id parameter granted they can access the shortcode output.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| letscms | Binary MLM Plan | 0 – through 5.0 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N