CVE-2026-15246 is a vulnerability in the RealHomes Memberships WordPress plugin prior to version 3.1.0. The flaw is due to insufficient verification of data authenticity (CWE-345) and improper access control (CWE-862). Specifically, the plugin fails to confirm that a membership payment transaction has been completed and does not validate a nonce or the user's capability before assigning paid membership packages. This allows authenticated users with minimal privileges to escalate their membership status without paying.

An attacker with an authenticated user account, such as a Subscriber, can exploit this vulnerability to gain unauthorized paid membership privileges. This could lead to unauthorized access to premium features or content intended only for paying members. There is no direct confidentiality or availability impact reported, but the integrity of membership status is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting user roles that can access membership features or monitor for unauthorized membership upgrades. Avoid granting unnecessary privileges to low-level users. Follow vendor updates closely for an official patch.