CVE-2025-11895: WordPress Binary MLM Plan IDOR Vulnerability

CVE-2025-11895 Overview

CVE-2025-11895 is an Insecure Direct Object Reference (IDOR) vulnerability in the Binary MLM Plan plugin for WordPress. The flaw affects all versions up to and including 5.0. The vulnerable bmp_user_payout_detail_of_current_user() function retrieves payout records by id without verifying that the requesting user owns the record. Authenticated users assigned the bmp_user role, which is commonly mapped to subscriber-level accounts, can read other members' payout summaries. Exploitation requires sending crafted requests to the /bmp-account-detail/ endpoint with a manipulated payout-id parameter, provided the attacker can reach the shortcode output.

Critical Impact
Low-privileged authenticated members can enumerate and view payout summary data belonging to other users of the MLM plugin.

Affected Products

Binary MLM Plan plugin for WordPress, versions up to and including 5.0
WordPress sites exposing the /bmp-account-detail/ shortcode endpoint
Deployments that assign the bmp_user role to subscribers or members

Discovery Timeline

2025-10-17 - CVE-2025-11895 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11895

Vulnerability Analysis

The vulnerability is a classic Insecure Direct Object Reference issue tracked as [CWE-639]. The plugin's bmp_user_payout_detail_of_current_user() function accepts a payout-id parameter supplied by the client and queries payout records using that identifier alone. The function performs no ownership check tying the requested payout record back to the authenticated user's account. As a result, any authenticated user who can render the shortcode output can substitute another user's payout-id value and receive that user's payout summary in the response.

Exploitation requires only low privileges. An account holding the bmp_user role, typically assigned to subscribers on member-driven WordPress sites, is sufficient. The attack vector is network-based and the attack complexity is low, but the confidentiality impact is limited to payout summary data exposed by the vulnerable endpoint.

Root Cause

The root cause is missing authorization logic in bmp_user_payout_detail_of_current_user(). The function trusts the payout-id request parameter as a lookup key without validating that the corresponding record belongs to the current session user. The plugin source at WordPress Plugin Code Review shows the query is executed based solely on the submitted identifier.

Attack Vector

An authenticated attacker with the bmp_user role visits the /bmp-account-detail/ page that renders the plugin shortcode. The attacker replaces the payout-id value in the request with an arbitrary numeric identifier belonging to another member. The plugin returns that member's payout summary because the ownership check is absent. Iterating through sequential identifiers enables enumeration of payout data across the member base. See the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2025-11895

Indicators of Compromise

Web server access logs showing repeated requests to /bmp-account-detail/ with incrementing or varying payout-id values from the same session or IP address
Authenticated sessions belonging to bmp_user or subscriber accounts issuing high volumes of requests to the payout endpoint
Requests to the endpoint originating from user accounts that do not own the referenced payout identifiers

Detection Strategies

Correlate the payout-id parameter in access logs with the authenticated user identifier to flag mismatches between requester and record owner
Alert on enumeration patterns such as sequential payout-id values requested by a single account within a short window
Review WordPress audit logs for subscriber-level accounts accessing member payout content outside of expected usage patterns

Monitoring Recommendations

Enable HTTP request logging on the WordPress front end and retain query string parameters for /bmp-account-detail/
Deploy a Web Application Firewall (WAF) rule to inspect and rate limit requests to the vulnerable endpoint
Baseline normal payout endpoint traffic per user role and alert on deviations, particularly from low-privileged accounts

How to Mitigate CVE-2025-11895

Immediate Actions Required

Identify all WordPress sites running the Binary MLM Plan plugin and confirm the installed version
Restrict access to the /bmp-account-detail/ page while a fixed release is unavailable, for example by limiting the shortcode to administrator-reviewed pages
Review payout records and access logs for evidence of unauthorized retrieval by non-owner accounts

Patch Information

No vendor-supplied fixed version is listed in the referenced advisories at the time of publication. Monitor the WordPress Plugin Code Review trunk and the Wordfence Vulnerability Report for a patched release, and upgrade as soon as one is published.

Workarounds

Temporarily disable the Binary MLM Plan plugin on affected sites until a patched version is released
Remove or gate the /bmp-account-detail/ shortcode behind additional access controls that verify record ownership before rendering payout data
Apply a WAF rule that blocks requests to the endpoint where the authenticated user identifier does not match the requested payout-id

bash

# Example WAF-style rule concept for the vulnerable endpoint
# Block requests to /bmp-account-detail/ where the payout-id parameter
# is present and the request does not originate from an administrator role.
SecRule REQUEST_URI "@beginsWith /bmp-account-detail/" \
    "chain,deny,status:403,id:1011895,msg:'CVE-2025-11895 IDOR block'"
SecRule ARGS:payout-id "@rx ^[0-9]+$"