Premium Packages – Sell Digital Products Securely: Privilege escalation or authentication bypass

Premium Packages – Sell Digital Products Securely is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 7.0.4.

CVE / CNA score 6.3 CVSS 3.1 · security@wordfence.com

NVD score Pending NVD has not published its own CVSS assessment.

Component: Premium Packages – Sell Digital Products Securely
Plugin slug: wpdm-premium-packages
Affected: <= 7.0.4
Safe version: > 7.0.4
Published: Jul 23, 2026
Weakness: CWE-287 — Improper Authentication

This CVE was published Jul 23, 2026 and is one of 11 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Premium Packages – Sell Digital Products Securely to a release after 7.0.4, or disable and remove it until a fixed version is available.

Source record

Technical description

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

Patch or disable the affected component.

Technical description

Primary and upstream sources