Is my WordPress plugin safe?

• Aug 6, 2026RealHomes Memberships: Does not verify that a membership payment actually completedCVE-2026-15246 · fixed in 3.1.0 · reported by WPScanMedium 4.3

  The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages without paying.

  NVD recordwpscan.com

• Aug 1, 2026RealHomes Memberships: Authorization bypassCVE-2026-10782 · affects up to 3.0.9 · reported by WordfenceMedium 4.3

  The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves any premium membership tier without completing a PayPal transaction, generating a falsified active payment receipt and gaining unauthorized access to restricted property listing allowances.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.