Vulnerabilities / Premium Packages / WPSEC-2026-1961
Premium Packages <= 7.3.0 - Unauthenticated Insecure Direct Object Reference to Guest Billing Information Update
Low 3.7
CWE-639Fixed in 7.3.1
- ID
- WPSEC-2026-1961
- Plugin
- Premium Packages – Sell Digital Products Securely (wpdm-premium-packages)
- Affected
- all versions before 7.3.1
- Remediation
- Update to 7.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- Premium Packages on WPSec AttackSurface
- Fix released
- Published
Description
The Premium Packages plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'update_guest_billing' AJAX action in all versions up to, and including, 7.3.0, due to the handler trusting any encrypted order ID supplied in the 'oid' parameter without verifying that the requester owns the order. This makes it possible for unauthenticated attackers who obtain an encrypted order reference, including values encrypted with the same key in other contexts such as password reset links, to overwrite the billing information of other customers' orders.
References
- https://wpsec.com/vuln/WPSEC-2026-1961/
- https://plugins.svn.wordpress.org/wpdm-premium-packages/tags/7.3.1/
- https://wordpress.org/plugins/wpdm-premium-packages/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS