The Binary MLM Plan plugin is affected by an insecure direct object reference that allows any authenticated user with the "bmp_user" role, often subscribers, to obtain the payouts of other members. The vulnerability resides in the bmp_user_payout_detail_of_current_user() function, which retrieves payout records solely by their ID with no ownership check. An attacker can therefore craft a direct request to the /bmp-account-detail/ endpoint, passing a payout-id for another user, and receive that user’s payout summary. This flaw enables unauthorized disclosure of confidential financial information of other members, but does not provide code execution or broader system compromise.

Vendors: letscms. Product: Binary MLM Plan plugin for WordPress. Versions up to and including 5.0 are impacted. Any WordPress site that has installed this plugin and allows subscribers to view the shortcode output is vulnerable. Sites running the 5.1 or newer release are not affected.

The CVSS score is 4.3, indicating a moderate risk. The EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The exploit requires an authenticated user with the bmp_user role and access to the shortcode output; the attacker can then issue a straightforward HTTP GET request to /bmp-account-detail/?payout-id= to retrieve another member’s data. No special infrastructure or administrative privileges beyond the role are needed, making the attack path relatively simple for any legitimate subscriber who wishes to view other users’ payouts.