{
 "id": "WPSEC-2026-2059",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2059/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2059/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2059/index.md",
 "title": "Premium Packages <= 7.3.1 - Unauthenticated Insecure Direct Object Reference via Abandoned Cart Recovery Link",
 "description": "The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Insecure Direct Object Reference via the abandoned cart recovery link (/acr/{order_id}/) in all versions up to, and including, 7.3.1. This is due to the recovery handler accepting any order ID without a signed key or an ownership check. This makes it possible for unauthenticated attackers who know or guess an order ID to load another buyer's order and cart into their own session. Because the plugin then treats that order as the visitor's current order at checkout, the attacker can also overwrite the items of another buyer's unpaid order and gain guest-session access to view it.",
 "plugin": {
  "slug": "wpdm-premium-packages",
  "name": "Premium Packages",
  "full_name": "Premium Packages – Sell Digital Products Securely",
  "wordpress_org": "https://wordpress.org/plugins/wpdm-premium-packages/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpdm-premium-packages/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpdm-premium-packages"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.3.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.3.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.3.2",
 "remediation": "Update to 7.3.2 or later.",
 "fix_released": "2026-10-29T12:05:06+00:00",
 "published": "2026-10-30T12:49:34+00:00",
 "updated": "2026-10-29T17:43:02.253617+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2059/",
  "https://plugins.svn.wordpress.org/wpdm-premium-packages/tags/7.3.2/",
  "https://wordpress.org/plugins/wpdm-premium-packages/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpdm-premium-packages",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}