Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-19711 The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authentic… https://www.cve.org/CVERecord?id=CVE-2026-19711
Post summary
This brief notice reveals a validation weakness in the Premium Packages WordPress plugin that could allow authorized users to withdraw funds they are not entitled to.
🚨*CVE* CVE-2026-19711 The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authentic… https://www.cve.org/CVERecord?id=CVE-2026-19711 ----- Traducción: CVE-2026-19711 The… https://infoflow.cloud`
Post summary
The post briefly discloses a validation flaw in the Premium Packages WordPress plugin (CVE-2026‑19711) that could allow authenticated users to withdraw funds improperly, with no evidence of active exploitation, patches, or proof‑of‑concept.