# Premium Packages <= 7.3.1 - Authenticated (Subscriber+) Insecure Direct Object Reference via Pay Now and Renew

- **ID:** WPSEC-2026-2058
- **Plugin:** Premium Packages – Sell Digital Products Securely (`wpdm-premium-packages`), https://wordpress.org/plugins/wpdm-premium-packages/
- **Affected versions:** all versions before 7.3.2
- **Fixed in:** 7.3.2 (Update to 7.3.2 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpdm-premium-packages
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2058/

## Description

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Pay Now and Renew feature (the 'wpdmpp_payment_intent' AJAX action) in all versions up to, and including, 7.3.1. This is due to missing ownership validation on the user-supplied 'order_id' parameter, and the handler also had no nonce check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to start payment on other buyers' orders and change their payment method and payment status, for example setting a completed order back to Pending. Because the payment gateways then stored the processed order ID as the session's guest order, the attacker can also view other buyers' guest orders.

## References

- https://wpsec.com/vuln/WPSEC-2026-2058/
- https://plugins.svn.wordpress.org/wpdm-premium-packages/tags/7.3.2/
- https://wordpress.org/plugins/wpdm-premium-packages/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2058/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.