CVE-2025-10038: CWE-266 Incorrect Privilege Assignment in letscms Binary MLM Plan
The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role granting all users with the manage_bmp capability by default upon registration through the plugin's form. This makes it possible for unauthenticated attackers to register and manage the plugin's settings.
AI Analysis
Technical Summary
CVE-2025-10038 is an incorrect privilege assignment vulnerability (CWE-266) in the Binary MLM Plan plugin for WordPress. The plugin grants the bmp_user role the manage_bmp capability by default to any user registering via the plugin's form. This allows unauthenticated users to escalate privileges and manage plugin settings. The vulnerability affects all versions up to and including 3.0. No patch or official fix information is provided in the available data.
Potential Impact
An unauthenticated attacker can register through the plugin's form and receive elevated privileges that allow management of the plugin's settings. This could lead to unauthorized configuration changes within the plugin, potentially impacting the integrity and security of the affected WordPress site. There is no indication of impact beyond limited privilege escalation or of any known exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor user registrations through the plugin's form if possible. Consider disabling or removing the plugin if it is not essential. Follow updates from the vendor for any released patches or official mitigations.
CVE-2025-10038: CWE-266 Incorrect Privilege Assignment in letscms Binary MLM Plan
Description
The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role granting all users with the manage_bmp capability by default upon registration through the plugin's form. This makes it possible for unauthenticated attackers to register and manage the plugin's settings.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-10038 is an incorrect privilege assignment vulnerability (CWE-266) in the Binary MLM Plan plugin for WordPress. The plugin grants the bmp_user role the manage_bmp capability by default to any user registering via the plugin's form. This allows unauthenticated users to escalate privileges and manage plugin settings. The vulnerability affects all versions up to and including 3.0. No patch or official fix information is provided in the available data.
Potential Impact
An unauthenticated attacker can register through the plugin's form and receive elevated privileges that allow management of the plugin's settings. This could lead to unauthorized configuration changes within the plugin, potentially impacting the integrity and security of the affected WordPress site. There is no indication of impact beyond limited privilege escalation or of any known exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor user registrations through the plugin's form if possible. Consider disabling or removing the plugin if it is not essential. Follow updates from the vendor for any released patches or official mitigations.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-09-05T17:35:09.789Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 68ef5c7bc4f69c9730e5692f
Added to database: 10/15/2025, 8:34:03 AM
Last enriched: 4/9/2026, 3:44:11 PM
Last updated: 5/10/2026, 2:34:46 AM
Views: 134
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.