Security Advisory

CVE-2026-19711

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-16 06:00:15

Last updated 2026-08-17 20:25:23

Assigner WPScan

CVSS score 6.5

State PUBLISHED

Description

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.

← Browse all CVEs View on cve.org ↗