Authorization Bypass in RealHomes Memberships Plugin for WordPress

CVE-2026-10782

What is CVE-2026-10782?

The RealHomes Memberships plugin for WordPress is susceptible to an authorization bypass issue across all versions up to and including 3.0.9. This vulnerability arises due to inadequate validation mechanisms that fail to ensure users are properly authorized before executing certain actions. Authenticated attackers with subscriber-level privileges or higher can exploit this weakness to elevate their access, enabling them to grant themselves premium membership tiers without requisite payments through PayPal, thereby generating fraudulent payment receipts and unjustly accessing restricted property listings.

References