The Premium Packages WordPress plugin before 7.0.7 fails to validate a withdrawal request against the user’s actual earned balance, allowing any authenticated user — including subscribers with no sales — to submit a payout request for an arbitrary amount. The flaw gives the requester financial integrity abuse: they can obtain funds without legitimate sales. This weakness corresponds to CWE‑284 (Improper Authorization). The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of <1% suggests low observable exploitation risk. No KEV listing is issued, yet the financial risk is significant.

The vulnerability exists in the Premium Packages WordPress plugin for any version prior to 7.0.7. It affects installations that use the plugin for managing digital product sales and withdrawals, regardless of the WordPress site’s admin configuration. Only users who are logged in and have access to the withdrawal request interface are affected; the flaw does not allow unauthenticated users to initiate withdrawals.

The risk is moderate to high because the flaw allows authenticated users to request arbitrary payouts that an administrator can approve. The CVSS score of 6.5 reflects this moderate severity, while the EPSS <1% indicates low observable exploitation risk but does not diminish the potential impact if a user can get admin approval. The likely attack vector is internal, requiring only WordPress authentication; no network exploitation is needed. This inference is based on the description that the flaw affects authenticated users. The unvalidated balance check removes a critical safeguard, exposing substantial financial loss if abused.