CVE-2025-10038 Overview
The Binary MLM Plan plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 3.0. The plugin registers a custom bmp_user role that automatically grants the manage_bmp capability to every user who signs up through the plugin's registration form. Unauthenticated attackers can register accounts and gain the ability to manage plugin settings. The issue is tracked under CWE-266: Incorrect Privilege Assignment.
Critical Impact
Unauthenticated attackers can self-register and obtain the manage_bmp capability, allowing them to modify plugin configuration on affected WordPress sites.
Affected Products
- Binary MLM Plan plugin for WordPress — all versions through 3.0
- Fixed in Binary MLM Plan version 5.0
- WordPress sites exposing the plugin's registration form
Discovery Timeline
- 2025-10-15 - CVE-2025-10038 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10038
Vulnerability Analysis
The Binary MLM Plan plugin defines a custom WordPress role named bmp_user and assigns it the manage_bmp capability. This role is applied by default to any account created through the plugin's registration form. Because the form is exposed to unauthenticated visitors, an attacker can register a new account and immediately gain access to plugin-managed settings.
The manage_bmp capability governs configuration endpoints registered in class-bmp-admin-menus.php and hook logic in bmp-hook-functions.php. Any user with this capability can reach those endpoints and alter plugin behavior. The impact is limited to plugin-scoped settings rather than full WordPress administrator privileges.
Root Cause
The root cause is an insecure default role configuration. The plugin conflates "registered user of the MLM system" with "administrator of the MLM system," granting the same privileged capability to both. Public self-registration combined with automatic capability assignment turns a customer role into an administrative role for the plugin.
Attack Vector
An unauthenticated attacker locates a WordPress site running Binary MLM Plan ≤ 3.0 and submits the plugin's public registration form. WordPress creates the account with the bmp_user role, which carries the manage_bmp capability. The attacker authenticates with the new credentials and issues requests to the plugin's management endpoints to modify settings.
Code-level details of the vulnerable role assignment and the corresponding fix are available in the WordPress Plugin Change Log for class-bmp-admin-menus.php and the change log for bmp-hook-functions.php.
Detection Methods for CVE-2025-10038
Indicators of Compromise
- Unexpected WordPress user accounts assigned the bmp_user role.
- Newly created accounts holding the manage_bmp capability without administrator approval.
- Access log entries showing POST requests to the Binary MLM Plan registration endpoint from unknown IP addresses.
- Unauthorized changes to Binary MLM Plan settings recorded in the WordPress options table.
Detection Strategies
- Query the WordPress wp_usermeta table for users whose wp_capabilities value contains bmp_user and validate each entry against expected registrations.
- Review WordPress audit logs for role changes and capability grants involving manage_bmp.
- Correlate web server logs for unauthenticated traffic reaching the plugin's registration form followed by authenticated administrative activity from the same source.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record user registrations, role assignments, and plugin setting changes.
- Alert on any creation of accounts with non-default roles such as bmp_user.
- Monitor for spikes in registrations against sites running the Binary MLM Plan plugin.
How to Mitigate CVE-2025-10038
Immediate Actions Required
- Update the Binary MLM Plan plugin to version 5.0 or later on all WordPress installations.
- Audit existing users for the bmp_user role and remove or downgrade any account that was not intentionally provisioned.
- Rotate credentials and invalidate active sessions for any accounts that may have been created through the vulnerable form.
Patch Information
The vendor addressed the issue in Binary MLM Plan version 5.0. The changeset removes the automatic assignment of the manage_bmp capability to the bmp_user role at registration. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Overview for release details.
Workarounds
- Disable the Binary MLM Plan plugin until it can be upgraded to version 5.0 or later.
- Restrict access to the plugin's registration form using web application firewall rules or .htaccess IP allowlists.
- Manually revoke the manage_bmp capability from the bmp_user role using a role editor plugin or a custom remove_cap() call until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
