PT-2026-63788 · Codename065 · The Premium Packages – Sell Digital Products Securely

·

CVE-2026-15348

·

Published

2026-07-23

·

Updated

2026-07-23

CVSS v3.1

6.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download() function — hooked to the unauthenticated WordPress wp action — decoding the attacker-controlled wpdmppdl parameter using only base64 decode() and json decode() with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.

Fix

Improper Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-15348

Affected Products

The Premium Packages – Sell Digital Products Securely