# Premium Packages <= 7.3.0 - Unauthenticated Payment Bypass via PayPal Subscription Activation

- **ID:** WPSEC-2026-1962
- **Plugin:** Premium Packages – Sell Digital Products Securely (`wpdm-premium-packages`), https://wordpress.org/plugins/wpdm-premium-packages/
- **Affected versions:** from 7.0.0 before 7.3.1
- **Fixed in:** 7.3.1 (Update to 7.3.1 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpdm-premium-packages
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1962/

## Description

The Premium Packages plugin for WordPress is vulnerable to a payment bypass via the PayPal subscription activation REST endpoint in all versions up to, and including, 7.3.0. This is due to insufficient verification that the supplied PayPal subscription belongs to the order being completed: any ACTIVE subscription was accepted. This makes it possible for unauthenticated attackers to complete orders for paid products using an unrelated active subscription, such as a cheap plan or a free trial, and obtain the purchased items without paying the order's price.

## References

- https://wpsec.com/vuln/WPSEC-2026-1962/
- https://plugins.svn.wordpress.org/wpdm-premium-packages/tags/7.3.1/
- https://wordpress.org/plugins/wpdm-premium-packages/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1962/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.