CVE-2026-19711 Premium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request
Authenticated users can request arbitrary withdrawal amounts regardless of their actual balance, potentially leading to unauthorized financial payouts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19711?
CVE-2026-19711 is a medium-severity vulnerability in Unknown Premium Packages, published on 16 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.
Weakness: CWE-284
Which versions are affected by CVE-2026-19711?
How do I fix CVE-2026-19711?
No fix has been published for CVE-2026-19711 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-19711 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-19711 exists.
Sources
Also known as GHSA-m363-6834-c3r7.