{"id":"CVE-2026-15348","aliases":["EUVD-2026-47900","GHSA-x4pq-v9hh-jm27"],"status":"published","title":"Premium Packages \u003c= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter","description":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00581,"percentile":0.48226,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-07-23T09:33:56Z","modified":"2026-07-23T15:14:51Z","products":[{"vendor":"codename065","product":"premium packages – sell digital products securely"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0183866d-1eab-4982-b62e-77751c7e738c?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/wpdm-premium-packages.php#L637"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/wpdm-premium-packages.php#L637"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/wpdm-premium-packages.php#L585"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/includes/libs/functions.php#L1811"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/wpdm-premium-packages.php#L632"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/wpdm-premium-packages.php#L119"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/wpdm-premium-packages.php#L585"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/includes/libs/functions.php#L1811"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/wpdm-premium-packages.php#L632"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/wpdm-premium-packages.php#L119"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3611573%40wpdm-premium-packages\u0026new=3611573%40wpdm-premium-packages"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15348"},{"url":"https://github.com/advisories/GHSA-x4pq-v9hh-jm27"}],"sources":{"cve":[{"id":"CVE-2026-15348","title":"Premium Packages \u003c= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter","description":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.","status":"published","published":"2026-07-23T09:33:56.289Z","modified":"2026-07-23T13:54:38.4Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-47900","description":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.","status":"published","published":"2026-07-23T09:33:56Z","modified":"2026-07-23T13:54:38Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:19:44.021778Z"}],"ghsa":[{"id":"GHSA-x4pq-v9hh-jm27","title":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to...","description":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.","status":"published","published":"2026-07-23T12:32:21Z","modified":"2026-07-23T12:32:46Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:09:41.313083Z"}],"nvd":[{"id":"CVE-2026-15348","description":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.","status":"published","published":"2026-07-23T10:16:50.303Z","modified":"2026-07-23T15:14:51.013Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:32.473901Z"}]}}