The Binary MLM Plan plugin for WordPress contains a flaw that allows unauthenticated users to register a role with the manage_bmp capability. This role grants the ability to adjust the plugin’s settings, effectively giving the attacker control over the plugin configuration. The vulnerability can be exploited by simply submitting a registration form on a site that hosts the plugin.

WordPress sites running the Binary MLM Plan plugin – all releases up to and including version 3.0. The affected product is listed as letscms:Binary MLM Plan. Any installation of this plugin in those versions is susceptible.

The CVSS score of 6.5 indicates a moderate overall risk, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw via a normal HTTP POST to the plugin’s registration form, an unauthenticated network vector that is widely reachable. Given the nature of the flaw, a successful exploitation could allow the attacker to modify plugin behavior or use the plugin as a foothold for further attacks on the underlying WordPress installation.