CVE-2026-15348
MediumCVSS 6.3Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress versions up to 7.0.4 contain an authentication bypass vulnerability via the 'wpdmppdl' parameter, allowing unauthenticated attackers to log in as any non-administrator user (e.g., subscriber, customer, author) who owns an order, by decoding the parameter without HMAC or signature verification.
Risk Assessment
The risk involves account takeover of any non-administrator user, potentially leading to unauthorized access to orders, customer data, or premium features.
Recommendation
Immediately update the Premium Packages plugin to a version above 7.0.4 that fixes this vulnerability.
Other vulnerabilities in Premium Packages
See all- CVE-2026-93511Medium
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.
- CVE-2026-19711Medium
The Premium Packages WordPress plugin before version 7.0.7 does not validate withdrawal requests against the user's actual balance, allowing any authenticated user, including a subscriber with no sales, to request arbitrary payouts that an admin may approve.
Original NVD description (English source)
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.