CVE-2023-4293

HighCVSS 8.8

Published: 12/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.79%

52th percentile - higher than 52% of all known CVEs

Summary

The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to and including 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This allows authenticated attackers with minimal permissions, such as a subscriber, to modify their user role.

Risk Assessment

Attackers may gain elevated privileges, potentially leading to unauthorized access to sensitive data or functions within the WordPress system.

Recommendation

It is recommended to update the plugin to the latest version to mitigate this vulnerability and review user permissions within the system.

Other vulnerabilities in Premium Packages - Sell Digital Products Securely plugin for WordPress

CVE-2026-15906Medium
The Premium Packages plugin for WordPress up to version 7.0.4 has an SQL injection vulnerability via the 'orderby' parameter. Insufficient escaping allows authenticated attackers with admin-level access to append SQL queries, potentially extracting sensitive database information.

Original NVD description (English source)

The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS