CVE-2025-10038

The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role granting all users with the manage_bmp capability by default upon registration through the plugin's form. This makes it possible for unauthenticated attackers to register and manage the plugin's settings.

• CWE-266

• https://plugins.trac.wordpress.org/changeset/3380455/binary-mlm-plan/tags/5.0/includes/admin/class-bmp-admin-menus.php?old=3259986&old_path=binary-mlm-plan%2Ftags%2F3.0%2Fincludes%2Fadmin%2Fclass-bmp-admin-menus.php
• https://plugins.trac.wordpress.org/changeset/3380455/binary-mlm-plan/tags/5.0/includes/bmp-hook-functions.php?old=3259986&old_path=binary-mlm-plan%2Ftags%2F3.0%2Fincludes%2Fbmp-hook-functions.php
• https://wordpress.org/plugins/binary-mlm-plan/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7951c8e4-b610-4cc4-ab27-4cfa78d72302?source=cve

Published

Oct 15, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10032A vulnerability was detected in Campcodes Grocery Sales and …6.1
• CVE-2025-10033A vulnerability has been found in itsourcecode Online Discus…9.8
• CVE-2025-10034A vulnerability was found in D-Link DIR-825 1.08.01. This im…9.8
• CVE-2025-10035A deserialization vulnerability in the License Servlet of Fo…9.8
• CVE-2025-10036The Featured Image from URL (FIFU) plugin for WordPress is v…4.9
• CVE-2025-10037The Featured Image from URL (FIFU) plugin for WordPress is v…4.9
• CVE-2025-10039The ELEX WordPress HelpDesk & Customer Ticketing System plug…4.3
• CVE-2025-1004Certain HP LaserJet Pro printers may potentially experience …5.3
• CVE-2025-10040The WP Import – Ultimate CSV XML Importer for WordPress plug…7.7
• CVE-2025-10041The Flex QR Code Generator plugin for WordPress is vulnerabl…9.8
• CVE-2025-10042The Quiz Maker plugin for WordPress is vulnerable to SQL Inj…7.5
• CVE-2025-10043Rejected reason: Considered by the maintainers a bug scenari…