CVE-2026-19711: CWE-284 Improper Access Control in Premium Packages
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.
AI Analysis
Technical Summary
CVE-2026-19711 is an improper access control vulnerability (CWE-284) in the Premium Packages WordPress plugin prior to version 7.0.7. The plugin does not verify that a withdrawal request corresponds to the user's actual earned balance, enabling any authenticated user to request payouts for arbitrary amounts regardless of their sales history. This could lead to unauthorized payout requests being submitted and potentially approved by administrators.
Potential Impact
Any authenticated user, including those without any earned balance, can submit withdrawal requests for arbitrary amounts. If an administrator approves these requests, it could result in unauthorized payouts, leading to potential financial loss or abuse of the payout system.
Mitigation Recommendations
No official fix or patch is currently confirmed or available. Users should monitor the vendor advisory for updates regarding a patch or official remediation. Until a fix is released, administrators should carefully verify withdrawal requests before approval to prevent unauthorized payouts.
CVE-2026-19711: CWE-284 Improper Access Control in Premium Packages
Description
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19711 is an improper access control vulnerability (CWE-284) in the Premium Packages WordPress plugin prior to version 7.0.7. The plugin does not verify that a withdrawal request corresponds to the user's actual earned balance, enabling any authenticated user to request payouts for arbitrary amounts regardless of their sales history. This could lead to unauthorized payout requests being submitted and potentially approved by administrators.
Potential Impact
Any authenticated user, including those without any earned balance, can submit withdrawal requests for arbitrary amounts. If an administrator approves these requests, it could result in unauthorized payouts, leading to potential financial loss or abuse of the payout system.
Mitigation Recommendations
No official fix or patch is currently confirmed or available. Users should monitor the vendor advisory for updates regarding a patch or official remediation. Until a fix is released, administrators should carefully verify withdrawal requests before approval to prevent unauthorized payouts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-13T10:33:17.336Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8154acbf8831d53998d6ea
Added to database: 08/16/2026, 06:11:56 UTC
Last enriched: 08/16/2026, 06:29:12 UTC
Last updated: 08/16/2026, 17:24:03 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.