CVE-2026-15348 PUBLISHED

Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter

Assigner: Wordfence
Reserved: 09.07.2026 Published: 23.07.2026 Updated: 23.07.2026

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download() function — hooked to the unauthenticated WordPress wp action — decoding the attacker-controlled wpdmppdl parameter using only base64_decode() and json_decode() with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS Score: 6.3

Product Status

Vendor codename065
Product Premium Packages – Sell Digital Products Securely
Versions Default: unaffected
  • affected from 0 to 7.0.4 (incl.)

Credits

  • Wordfence PRISM finder

References

Problem Types

  • CWE-287 Improper Authentication CWE