Premium Packages <= 7.3.1 - Unauthenticated Insecure Direct Object Reference via Abandoned Cart Recovery Link
- ID
- WPSEC-2026-2059
- Plugin
- Premium Packages – Sell Digital Products Securely (wpdm-premium-packages)
- Affected
- all versions before 7.3.2
- Remediation
- Update to 7.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Premium Packages on WPSec AttackSurface
- Fix released
- Published
Description
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Insecure Direct Object Reference via the abandoned cart recovery link (/acr/{order_id}/) in all versions up to, and including, 7.3.1. This is due to the recovery handler accepting any order ID without a signed key or an ownership check. This makes it possible for unauthenticated attackers who know or guess an order ID to load another buyer's order and cart into their own session. Because the plugin then treats that order as the visitor's current order at checkout, the attacker can also overwrite the items of another buyer's unpaid order and gain guest-session access to view it.
References
- https://wpsec.com/vuln/WPSEC-2026-2059/
- https://plugins.svn.wordpress.org/wpdm-premium-packages/tags/7.3.2/
- https://wordpress.org/plugins/wpdm-premium-packages/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS