{
 "id": "WPSEC-2026-1962",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1962/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1962/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1962/index.md",
 "title": "Premium Packages <= 7.3.0 - Unauthenticated Payment Bypass via PayPal Subscription Activation",
 "description": "The Premium Packages plugin for WordPress is vulnerable to a payment bypass via the PayPal subscription activation REST endpoint in all versions up to, and including, 7.3.0. This is due to insufficient verification that the supplied PayPal subscription belongs to the order being completed: any ACTIVE subscription was accepted. This makes it possible for unauthenticated attackers to complete orders for paid products using an unrelated active subscription, such as a cheap plan or a free trial, and obtain the purchased items without paying the order's price.",
 "plugin": {
  "slug": "wpdm-premium-packages",
  "name": "Premium Packages",
  "full_name": "Premium Packages – Sell Digital Products Securely",
  "wordpress_org": "https://wordpress.org/plugins/wpdm-premium-packages/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpdm-premium-packages/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpdm-premium-packages"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "7.0.0",
    "from_inclusive": true,
    "to": "7.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 7.0.0 before 7.3.1"
  ]
 },
 "introduced_in": "7.0.0",
 "fixed_in": "7.3.1",
 "remediation": "Update to 7.3.1 or later.",
 "fix_released": "2026-10-28T16:32:39+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:47:39.937407+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1962/",
  "https://plugins.svn.wordpress.org/wpdm-premium-packages/tags/7.3.1/",
  "https://wordpress.org/plugins/wpdm-premium-packages/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpdm-premium-packages",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}