Privilege Escalation Risk in Binary MLM Plan Plugin by WordPress

CVE-2025-10038

What is CVE-2025-10038?

The Binary MLM Plan plugin for WordPress contains a vulnerability that allows users to inadvertently gain increased privileges. Specifically, the bmp_user role is assigned the manage_bmp capability by default upon user registration via the plugin's form. This flaw can be exploited by unauthenticated attackers, enabling them to register for an account and subsequently manage the plugin's settings, posing a significant security risk to the WordPress site.

References