CVE-2026-10782

Name of the Vulnerable Software and Affected Versions RealHomes Memberships versions prior to 3.1.0

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can grant themselves any premium membership tier without completing a PayPal transaction. This allows the generation of a falsified active payment receipt and provides unauthorized access to restricted property listing allowances.

Recommendations Update RealHomes Memberships to version 3.1.0 or later.