CVE-2026-10782: RealHomes Memberships Auth Bypass Flaw

CVE-2026-10782 Overview

CVE-2026-10782 is an authorization bypass vulnerability in the RealHomes Memberships plugin for WordPress, affecting all versions up to and including 3.0.9. The plugin fails to properly verify that a user is authorized to perform a payment-related action within its PayPal payment handler. Authenticated attackers with subscriber-level access or above can grant themselves any premium membership tier without completing a PayPal transaction. The bypass generates a falsified active payment receipt and unlocks restricted property listing allowances tied to paid membership tiers. The weakness is tracked as CWE-862 (Missing Authorization).

Critical Impact
Authenticated subscribers can obtain premium membership tiers for free, forge payment receipts, and access restricted property listing features intended for paying customers.

Affected Products

RealHomes Memberships (Inspiry Memberships) plugin for WordPress
All versions up to and including 3.0.9
WordPress sites operating the RealHomes real estate theme ecosystem with the Memberships add-on

Discovery Timeline

2026-08-01 - CVE-2026-10782 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-10782

Vulnerability Analysis

The RealHomes Memberships plugin exposes a PayPal payment handler used to process membership purchases and grant tier upgrades. According to the referenced plugin source in class-paypal-payment-handler.php and payment-handler-init.php, the handler processes membership assignment logic without verifying that the requesting user is authorized to trigger the successful-payment code path. Any authenticated user, including a default WordPress subscriber, can reach this logic. The result is unauthorized elevation of membership state and creation of a falsified payment receipt record inside the site database.

Because the flaw exists in business logic that gates paid features rather than in an administrative interface, exploitation does not require elevated privileges or user interaction. The impact is limited to integrity of membership records and financial loss to the site operator; confidentiality of unrelated data and availability of the site are not directly affected.

Root Cause

The root cause is missing authorization ([CWE-862]) in the plugin's PayPal payment handler. The handler that finalizes membership assignment does not confirm the caller is a legitimate PayPal callback or the correct purchasing user. It also does not validate that a real PayPal transaction completed before writing an active payment receipt and upgrading the user's membership tier.

Attack Vector

An attacker authenticates to the WordPress site using any account at subscriber level or above. Self-registration on a public real estate site is often sufficient to obtain this role. The attacker then invokes the plugin's payment completion endpoint with parameters that map to a premium membership tier. The handler accepts the request, marks the membership active, and stores a falsified payment receipt. The attacker gains the property listing allowances tied to that tier without any funds moving through PayPal. No exploit code has been publicly released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

// Verified code examples are not published for this CVE.
// Refer to the affected source lines in the plugin repository:
// class-paypal-payment-handler.php lines 351 and 364
// payment-handler-init.php line 82

Detection Methods for CVE-2026-10782

Indicators of Compromise

Membership records in the WordPress database showing an active premium tier for users whose PayPal transaction history contains no matching charge.
Payment receipt entries created by the plugin without a corresponding PayPal transaction ID, or with reused or malformed transaction identifiers.
Subscriber accounts created shortly before an unexpected membership upgrade event, especially from newly registered email addresses.
Access log entries showing authenticated POST requests to the plugin's PayPal payment handler endpoints from IP ranges unrelated to PayPal IPN traffic.

Detection Strategies

Query the plugin's membership and receipt tables and reconcile every active premium record against actual PayPal transaction reports.
Review WordPress user registration logs for subscriber accounts that received a premium tier within minutes of registration.
Alert on HTTP requests to the plugin's payment handler routes that originate from authenticated session cookies but do not follow the expected PayPal redirect flow.

Monitoring Recommendations

Enable WordPress audit logging for user role, capability, and membership metadata changes.
Forward WordPress and web server logs to a central analytics platform and alert on anomalous access to payment-handler-init.php and class-paypal-payment-handler.php routes.
Monitor for spikes in new subscriber registrations followed by premium tier assignments, which indicate automated abuse of the bypass.

How to Mitigate CVE-2026-10782

Immediate Actions Required

Update the RealHomes Memberships plugin to a version later than 3.0.9 that includes the fix referenced in WordPress Change Set 3617226.
Audit all existing premium membership assignments and revoke tiers that cannot be matched to a verified PayPal transaction.
Force a password reset and re-verification for accounts flagged as suspicious during the audit.
Temporarily disable new user self-registration if a patch cannot be applied immediately.

Patch Information

The vendor addressed the missing authorization check in the plugin's PayPal payment handler in the release following version 3.0.9. Apply the patched version from the official WordPress plugin repository. Full remediation details are available in the Wordfence Vulnerability Report and the underlying source references at class-paypal-payment-handler.php line 351, line 364, and payment-handler-init.php line 82.

Workarounds

Deactivate the RealHomes Memberships plugin until the patched version can be installed if paid membership functionality is not business critical.
Restrict access to the plugin's payment handler endpoints at the web server or WAF layer, allowing requests only from documented PayPal IPN sources.
Change the default role for new registrations from Subscriber to a lower-privilege custom role that cannot invoke the payment handler.
Manually verify each new membership activation against PayPal transaction reports until patching is complete.

bash

# Example: block direct external POSTs to the vulnerable handler at the web server
# (nginx) - allow only PayPal IPN ranges to reach the payment handler
location ~ /wp-content/plugins/inspiry-memberships/resources/payment-handler/ {
    allow 173.0.80.0/20;      # PayPal IPN range (verify current PayPal-published ranges)
    deny  all;
}