CVE-2026-61948
CriticalCVSS 9.3Summary
The WPDM – Premium Packages plugin versions up to 6.2.0 are vulnerable to unauthenticated SQL injection.
Risk Assessment
An unauthenticated attacker can execute arbitrary SQL queries, potentially leading to data leakage or modification.
Recommendation
It is recommended to update the WPDM – Premium Packages plugin to a version later than 6.2.0.
Other vulnerabilities in WPDM – Premium Packages
See all- CVE-2026-61943High
The WPDM – Premium Packages plugin up to version 6.2.0 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
- CVE-2026-73190High
Unauthenticated Cross Site Scripting (XSS) vulnerability in WPDM – Premium Packages versions up to 7.0.5. An attacker can inject a malicious script that executes in the victim's browser.
Original NVD description (English source)
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.