Executive brief
The RealHomes Memberships plugin for WordPress, which manages premium real estate listing subscriptions, contains a security flaw that allows users to bypass payment requirements. An authenticated user with basic site access can grant themselves premium membership tiers without actually paying via PayPal. This results in a loss of revenue for site owners and unauthorized access to restricted property listing features.
Technical details
The RealHomes Memberships plugin for WordPress (versions <= 3.0.9) is vulnerable to an authorization bypass due to missing authorization checks in its payment handling logic (CWE-862). Specifically, the plugin fails to properly verify that a user is authorized to perform membership updates or that a PayPal transaction has been legitimately completed. An authenticated attacker with subscriber-level permissions can exploit this by sending crafted requests to the payment handler components (such as class-paypal-payment-handler.php), generating falsified active payment receipts. This enables the attacker to upgrade their account to any premium membership tier and access restricted property listing allowances without payment.
Affected products
- inspirythemes RealHomes Memberships up to, and including, 3.0.9
Timeline
- 2026-08-01: disclosed
- 2026-08-01: advisory
References
- https://plugins.trac.wordpress.org/browser/inspiry-memberships/tags/3.0.7/resources/payment-handler/class-paypal-payment-handler.php
- https://plugins.trac.wordpress.org/browser/inspiry-memberships/tags/3.0.7/resources/payment-handler/class-paypal-payment-handler.php
- https://plugins.trac.wordpress.org/browser/inspiry-memberships/tags/3.0.7/resources/payment-handler/payment-handler-init.php
- https://plugins.trac.wordpress.org/browser/inspiry-memberships/tags/3.0.9/resources/payment-handler/class-paypal-payment-handler.php
- https://plugins.trac.wordpress.org/browser/inspiry-memberships/tags/3.0.9/resources/payment-handler/class-paypal-payment-handler.php
- https://plugins.trac.wordpress.org/browser/inspiry-memberships/tags/3.0.9/resources/payment-handler/payment-handler-init.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3617226%40inspiry-memberships&new=3617226%40inspiry-memberships