Vulnerabilities / Premium Packages / WPSEC-2026-1962
Premium Packages <= 7.3.0 - Unauthenticated Payment Bypass via PayPal Subscription Activation
High 7.5
CWE-345Fixed in 7.3.1
- ID
- WPSEC-2026-1962
- Plugin
- Premium Packages – Sell Digital Products Securely (wpdm-premium-packages)
- Affected
- from 7.0.0 before 7.3.1
- Remediation
- Update to 7.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- Premium Packages on WPSec AttackSurface
- Fix released
- Published
Description
The Premium Packages plugin for WordPress is vulnerable to a payment bypass via the PayPal subscription activation REST endpoint in all versions up to, and including, 7.3.0. This is due to insufficient verification that the supplied PayPal subscription belongs to the order being completed: any ACTIVE subscription was accepted. This makes it possible for unauthenticated attackers to complete orders for paid products using an unrelated active subscription, such as a cheap plan or a free trial, and obtain the purchased items without paying the order's price.
References
- https://wpsec.com/vuln/WPSEC-2026-1962/
- https://plugins.svn.wordpress.org/wpdm-premium-packages/tags/7.3.1/
- https://wordpress.org/plugins/wpdm-premium-packages/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS