{"id":"CVE-2026-19711","aliases":["EUVD-2026-59914","GHSA-m363-6834-c3r7"],"status":"published","title":"Premium Packages – Sell Digital Products Securely \u003c 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request","description":"The Premium Packages  WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00299,"percentile":0.22922,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-08-16T06:00:15Z","modified":"2026-08-26T16:30:52Z","products":[{"vendor":"shahjada","product":"premium packages"},{"vendor":"unknown","product":"premium packages"}],"references":[{"url":"https://wpscan.com/vulnerability/ba209669-49bb-40f0-976d-7b77fa0a3c85/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19711"},{"url":"https://wpscan.com/vulnerability/ba209669-49bb-40f0-976d-7b77fa0a3c85"},{"url":"https://github.com/advisories/GHSA-m363-6834-c3r7"}],"sources":{"cve":[{"id":"CVE-2026-19711","title":"Premium Packages – Sell Digital Products Securely \u003c 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request","description":"The Premium Packages  WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.","status":"published","published":"2026-08-16T06:00:15.841Z","modified":"2026-08-17T20:25:23.705Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T13:47:17.512524Z"}],"euvd":[{"id":"EUVD-2026-59914","description":"The Premium Packages  WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.","status":"published","published":"2026-08-16T06:00:15Z","modified":"2026-08-17T20:25:23Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:48.026284Z"}],"ghsa":[{"id":"GHSA-m363-6834-c3r7","title":"The Premium Packages  WordPress plugin before 7.0.7 does not validate a withdrawal request...","description":"The Premium Packages  WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.","status":"published","published":"2026-08-16T06:30:26Z","modified":"2026-08-17T21:31:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:10:35.189726Z"}],"nvd":[{"id":"CVE-2026-19711","description":"The Premium Packages  WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.","status":"published","published":"2026-08-16T06:16:52.12Z","modified":"2026-08-26T16:30:52.723Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:38.647684Z"}]}}